fileforum.com Open in urlscan Pro
108.44.238.29 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://fileforum.com/profile/nurseraven8/
Submission: On February 22 via manual (February 22nd 2024, 7:42:35 am UTC) from KH — Scanned from IL

Summary HTTP 108 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 22 IPs in 3 countries across 13 domains to perform 108 HTTP transactions. The main IP is 108.44.238.29, located in Fredericksburg, United States and belongs to UUNET, US. The main domain is fileforum.com.
TLS certificate: Issued by R3 on January 3rd 2024. Valid for: 3 months.

This is the only time fileforum.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	108.44.238.29 108.44.238.29	701 (UUNET) (UUNET)
11	104.26.12.174 104.26.12.174	13335 (CLOUDFLAR...) (CLOUDFLARENET)
19	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
1	192.0.73.2 192.0.73.2	2635 (AUTOMATTIC) (AUTOMATTIC)
2	142.250.185.72 142.250.185.72	15169 (GOOGLE) (GOOGLE)
9	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
2	142.250.181.238 142.250.181.238	15169 (GOOGLE) (GOOGLE)
11	142.250.185.238 142.250.185.238	15169 (GOOGLE) (GOOGLE)
2	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
16	142.250.186.129 142.250.186.129	15169 (GOOGLE) (GOOGLE)
1	172.217.18.6 172.217.18.6	15169 (GOOGLE) (GOOGLE)
3 4	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
3 5	172.64.151.101 172.64.151.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 3	185.89.210.212 185.89.210.212	29990 (ASN-APPNEX) (ASN-APPNEX)
3	142.250.186.106 142.250.186.106	15169 (GOOGLE) (GOOGLE)
6	142.250.185.163 142.250.185.163	15169 (GOOGLE) (GOOGLE)
3	142.250.185.106 142.250.185.106	15169 (GOOGLE) (GOOGLE)
1 2	172.217.16.196 172.217.16.196	15169 (GOOGLE) (GOOGLE)
4	142.251.12.120 142.251.12.120	() ()
1	74.125.71.157 74.125.71.157	15169 (GOOGLE) (GOOGLE)
1 1	216.58.212.174 216.58.212.174	15169 (GOOGLE) (GOOGLE)
2	74.125.98.170 74.125.98.170	() ()
108	22

1 108.44.238.29 (Fredericksburg, United States)

ASN701 (UUNET, US)
PTR: phoenix.betanews.com

fileforum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.26.12.174 (None, )

ASN13335 (CLOUDFLARENET, US)

images.betanews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.73.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

www.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.72 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 172.217.16.130 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f130.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 142.250.185.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f14.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 142.250.186.129 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.6 (United States)

ASN15169 (GOOGLE, US)
PTR: fra02s19-in-f6.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.98 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.64.151.101 (San Francisco, United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.89.210.212 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.106 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.106 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f10.1e100.net

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.196 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f196.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.12.120 (None, )

ASN- ()

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.71.157 (United States)

ASN15169 (GOOGLE, US)
PTR: wn-in-f157.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.174 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s01-in-f14.1e100.net

gcdn.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.98.170 (None, )

ASN- ()

r5---sn-ua87sn76.c.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
35	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 105 tpc.googlesyndication.com — Cisco Umbrella Rank: 158 ade.googlesyndication.com Failed	590 KB
16	doubleclick.net 3 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 35 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 556 cm.g.doubleclick.net — Cisco Umbrella Rank: 264 bid.g.doubleclick.net — Cisco Umbrella Rank: 910	151 KB
13	google.com 1 redirects fundingchoicesmessages.google.com — Cisco Umbrella Rank: 663 www.google.com — Cisco Umbrella Rank: 2	71 KB
11	betanews.com images.betanews.com	87 KB
10	gstatic.com www.gstatic.com csi.gstatic.com fonts.gstatic.com	54 KB
6	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 28 imasdk.googleapis.com — Cisco Umbrella Rank: 477	139 KB
5	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 634	3 KB
4	2mdn.net 1 redirects s0.2mdn.net — Cisco Umbrella Rank: 321 gcdn.2mdn.net — Cisco Umbrella Rank: 1307 r5---sn-ua87sn76.c.2mdn.net	75 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 260	3 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	306 B
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	145 KB
1	gravatar.com www.gravatar.com — Cisco Umbrella Rank: 4015	5 KB
1	fileforum.com fileforum.com	3 KB
108	13

	Domain	Requested by
19	pagead2.googlesyndication.com	fileforum.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com
16	tpc.googlesyndication.com	fileforum.com googleads.g.doubleclick.net tpc.googlesyndication.com imasdk.googleapis.com pagead2.googlesyndication.com
11	fundingchoicesmessages.google.com	pagead2.googlesyndication.com
11	images.betanews.com	fileforum.com images.betanews.com
9	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
5	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
4	csi.gstatic.com	imasdk.googleapis.com
4	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net
3	fonts.gstatic.com	fonts.googleapis.com
3	imasdk.googleapis.com	googleads.g.doubleclick.net fileforum.com
3	www.gstatic.com	googleads.g.doubleclick.net
3	fonts.googleapis.com	googleads.g.doubleclick.net
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
2	r5---sn-ua87sn76.c.2mdn.net
2	www.google.com	1 redirects tpc.googlesyndication.com
2	googleads4.g.doubleclick.net	fileforum.com
2	www.google-analytics.com	www.googletagmanager.com
2	www.googletagmanager.com	fileforum.com www.googletagmanager.com
1	gcdn.2mdn.net	1 redirects
1	bid.g.doubleclick.net	imasdk.googleapis.com
1	s0.2mdn.net	googleads.g.doubleclick.net
1	www.gravatar.com	fileforum.com
1	fileforum.com
0	ade.googlesyndication.com Failed
108	24

This site contains links to these domains. Also see Links.

Domain
betanews.com
fileforum.betanews.com
store.fileforum.com
twitter.com
www.facebook.com

Subject Issuer	Validity	Valid
admin.betanews.com R3	`2024-01-03` - `2024-04-02`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-28` - `2024-04-27`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.gravatar.com Sectigo ECC Domain Validation Secure Server CA	`2023-12-05` - `2025-01-04`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.c.docs.google.com GTS CA 1C3	`2024-02-13` - `2024-04-23`	2 months	crt.sh

This page contains 15 frames:

Primary Page: https://fileforum.com/profile/nurseraven8/
Frame ID: 5817400EBFA2C0B0005AE593AE1A9D37
Requests: 34 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20190131/zrt_lookup_fy2021.html
Frame ID: D904DA041375D8F0962775DC76E1696E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6676241418785266&output=html&adk=1812271804&adf=3025194257&lmt=1708587749&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=260x1080_l%7C260x1080_r&format=0x0&url=https%3A%2F%2Ffileforum.com%2Fprofile%2Fnurseraven8%2F&pra=5&wgl=1&easpi=0&asro=0&aseiel=1~2~4~6~7&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708587750769&bpp=19&bdt=966&idt=675&shv=r20240220&mjsv=m202402150101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1396509222195&frm=20&pv=2&ga_vid=1928486355.1708587751&ga_sid=1708587751&ga_hid=1996822779&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31081152%2C42531706%2C95324581%2C95325069%2C95322181%2C95324155%2C95324161%2C95324435&oid=2&pvsid=2418963826889958&tmod=667275704&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=700
Frame ID: E1D19756C022A6DEABFCB3D1FB4EDE67
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6676241418785266&output=html&h=280&adk=3368998127&adf=2550651363&pi=t.aa~a.3269266735~rp.4&w=659&fwrn=4&fwrnh=100&lmt=1708587749&rafmt=1&to=qs&pwprc=8797158495&format=659x280&url=https%3A%2F%2Ffileforum.com%2Fprofile%2Fnurseraven8%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708587750788&bpp=2&bdt=985&idt=685&shv=r20240220&mjsv=m202402150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=1396509222195&frm=20&pv=1&ga_vid=1928486355.1708587751&ga_sid=1708587751&ga_hid=1996822779&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=310&ady=344&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31081152%2C42531706%2C95324581%2C95325069%2C95322181%2C95324155%2C95324161%2C95324435&oid=2&pvsid=2418963826889958&tmod=667275704&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=688
Frame ID: F51976EE315466767937652283836B79
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPeRExCMr4DzBRi5q6GIAjAB&v=APEucNXR9NRkQp9PNGXVwFyKxqIQipX5AGlnHotQ2P2Ciabsk8cgVcQnuAqDbF5Lcz6zc1IAU8YtQcBPg6XeaZmiAOFE0rSvpg
Frame ID: DD3070DACA616766B373E9D76CA17BD8
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/abg_lite_fy2021.js
Frame ID: 80B2A3E5547D4ED30FE7442BB060A8ED
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 586148A0A564D0180EF91F29A3EB3B66
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: D2F8D364E7E1883A1F4B19FCDCA338EA
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 6A7046FA52CD0C1BE0F633731FCA47DD
Requests: 29 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 78F6FDB8651A3B936ED8E65D64D4B027
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 0A21CE0148F138B3BB74B34B8B963162
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/p5fnC8UiJgY_rpObzZ9ptSWDjQ2aRmww7Wqd7-i_gkQ.js
Frame ID: 3F00715F9D140918D96A838B5BAF4015
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html
Frame ID: B887A9F0CFF158E2C46C5E6952D8C4DD
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: DA6A32BF12048460ED460313F4EB1156
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D99064E1FF0409ACF515E6EB99DF07E1
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

nurseraven8's Profile | FileForum

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Gravatar (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

<[^>]+gravatar\.com/avatar/

Page Statistics

108
Requests

87 %
HTTPS

0 %
IPv6

13
Domains

24
Subdomains

22
IPs

3
Countries

1321 kB
Transfer

4143 kB
Size

16
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://betanews.com/
Title: BetaNews

Search URL Search Domain Scan URL

URL: https://fileforum.betanews.com/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://store.fileforum.com/
Title: Software Store

Search URL Search Domain Scan URL

URL: http://twitter.com/FileForum
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/FileForum
Title: Facebook

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 32

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF1mY0RXOIqx5_Axr6Xfo6A&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF1mY0RXOIqx5_Axr6Xfo6A&google_cver=1&C=1

Request Chain 33

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zdb66IsFVsMAAFM4AGzo0AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENywz3Wk8-aU5rXCHGmf6XY&google_cver=1

Request Chain 34

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEJUF9euv9u6-MXX6zoa4hz0&google_cver=1

Request Chain 35

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjMzNTkyMzAxMTMwNjI0OTY2MQ%3D%3D

Request Chain 63

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 80

https://gcdn.2mdn.net/videoplayback/id/368f431842991a55/itag/22/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740123753/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signature/21F617468D3DEA43445D62115BCB6276370D3376.746FE470AD2275EDE2729FDEF5795B6043193C69/key/ck2/file/file.mp4 HTTP 302
https://r5---sn-ua87sn76.c.2mdn.net/videoplayback/id/368f431842991a55/itag/22/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740123753/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/75B15EF381A7E83651A011C455C33807029173BD.15E4E89D6A43FDD8A2C5A484613CFB6CAC5D9057/key/cms1/cms_redirect/yes/mh/g0/mip/31.187.78.153/mm/42/mn/sn-ua87sn76/ms/onc/mt/1708587153/mv/m/mvi/5/pl/24/file/file.mp4

108 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
fileforum.com/profile/nurseraven8/ 7 KB
3 KB 793ms
217ms Document
text/html 108.44.238.29
UUNET

General

Check archive.org

Show headers Download Go to

Full URL: https://fileforum.com/profile/nurseraven8/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.44.238.29 Fredericksburg, United States, ASN701 (UUNET, US),
Reverse DNS: phoenix.betanews.com
Software: Apache/2.4.10 (Debian) /
Resource Hash: 54a4b0a512bee3f1de5932be2c69af90bc212c67e46812cef71da9325bd5fa80

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

Cache-Control: private, must-revalidate, pre-check=0, post-check=0
Connection: close
Content-Encoding: gzip
Content-Length: 2352
Content-Type: text/html; charset=UTF-8
Date: Thu, 22 Feb 2024 07:42:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Thu, 22 Feb 2024 07:42:29 GMT
Pragma: no-cache
Server: Apache/2.4.10 (Debian)
Vary: Accept-Encoding

GET
H2 200 reset.css
images.betanews.com/stylesheets/fileforum3/ 886 B
742 B 355ms
122ms Stylesheet
text/css 104.26.12.174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://images.betanews.com/stylesheets/fileforum3/reset.css
Requested by: Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.174 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 160d317860d283845ddde93faa4a3c41f42f0e777acb74dba3a716555c89610f

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 08 Jul 2017 02:49:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4525
etag: W/"376-553c565bb7500-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qEe9YjcQ4nzOsIKkzWEd5pTqLlmJs5JIAq%2FXS1oqIGOr5OFpWpbmmaf3U06pCAipTN%2FtfShwNXVAdkqq%2B%2FxynCYAwQd4n75qDbY94BQPRV0BKNLq1Pz2sf4aX%2BKp3BbzHkzppBw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 859597be1adb0e4f-MXP

GET
H2 200 main.css
images.betanews.com/stylesheets/fileforum3/ 29 KB
7 KB 352ms
119ms Stylesheet
text/css 104.26.12.174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://images.betanews.com/stylesheets/fileforum3/main.css
Requested by: Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.174 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: deda914cce5fb739ca5624e64be7af22f3a426623b3bf174429287d2376dfc4b

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 11 Jul 2017 23:54:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4525
etag: W/"72a2-554136b4eee40-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cwpZbF3aB%2FuG8zx7MkY3d48d2ETnleqQvca8WKXqqyo1iYh2gxAiRQQpqOgLKx5RyWHaH0ZimaleooLsOfrS%2FJaE2l2mqB7YKp7Bj8EUM5lKp24z8ZKxilegRV9gT08OsRyPw0g%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 859597be1add0e4f-MXP

GET
H2 200 ffsite.js Show response
images.betanews.com/resources/ 137 KB
49 KB 356ms
123ms Script
application/javascript 104.26.12.174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://images.betanews.com/resources/ffsite.js
Requested by: Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.174 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f061bc61c6a752564bba70c0675de98f06d26b6fe0655c2189fba606539accab

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 08 Jul 2017 02:55:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4525
etag: W/"223e8-553c57b3fe140-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nMrm60T6Y08z5%2FbdMyss3w4sEQVqTuSD6DFUHXLRMtjvajcAwwrTECDldfuqKgbetcv8mXBoUxOTwf3E95Z5I3yx5G304Bes8vUVyq5tPvhudnwOA1oxbXadh%2Fzf4Bjh8PQVgKo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 859597be1ade0e4f-MXP

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 151 KB
51 KB 401ms
160ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6676241418785266

Requested by

Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

c505f5e6db32169df461ce182212a17730f85ef92957719327f7c7f6d76b4dd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
Origin: https://fileforum.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51592
x-xss-protection: 0
server: cafe
etag: 6256565670583047652
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Thu, 22 Feb 2024 07:42:30 GMT

GET
H2 200 7cad70e7905c928bd50a3cb619b630b8
www.gravatar.com/avatar/ 4 KB
5 KB 454ms
240ms Image
image/jpeg 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.gravatar.com/avatar/7cad70e7905c928bd50a3cb619b630b8?s=128
Requested by: Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5916e0b240cb97c609bce4253569ab210ddd5f3569b61d2c6ed8efe310844dc8

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: MISS mxp 1
date: Thu, 22 Feb 2024 07:42:30 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="7cad70e7905c928bd50a3cb619b630b8.jpg"
accept-ranges: bytes
link: <https://gravatar.com/avatar/7cad70e7905c928bd50a3cb619b630b8?s=128>; rel="canonical"
content-length: 4268
alt-svc: h3=":443"; ma=86400
expires: Thu, 22 Feb 2024 07:47:30 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 174 KB
63 KB 358ms
127ms Script
application/javascript 142.250.185.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WHTWSXS

Requested by

Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

28528db9f11cf1291c3e656a885c55cfd09e5f32d0b63805bdfd68cf5bdfe54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64051
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Feb 2024 07:42:30 GMT

GET
H2 200 navbar_active_gray.png
images.betanews.com/fileforum3/header/ 1006 B
1 KB 116ms
116ms Image
image/png 104.26.12.174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.betanews.com/fileforum3/header/navbar_active_gray.png
Requested by: Host: images.betanews.com
URL: https://images.betanews.com/stylesheets/fileforum3/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.174 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54b646173856c05ad595598fcfee96dc54495c2f9a30ea1c55515b64789d2803

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://images.betanews.com/stylesheets/fileforum3/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
cf-cache-status: HIT
last-modified: Tue, 11 Jul 2017 23:30:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4524
etag: "3ee-5541315c69180"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gj8XykcB9bnOn9TO9TJlz6QtSvguQtirajFljlIE4JeToxY4nY5SeLrppb3PI%2FRFtiNZVynffs20PozTUaDl2Z3VP5PNQGC%2Fuhm6ncHJoRCS3QvX%2Fta4u%2FRSWpNX4yzO9O%2FIDQo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 859597bfada50e4f-MXP
content-length: 1006

GET
H2 200 ff_logo_gray.png
images.betanews.com/fileforum3/header/ 1 KB
2 KB 131ms
131ms Image
image/png 104.26.12.174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.betanews.com/fileforum3/header/ff_logo_gray.png
Requested by: Host: images.betanews.com
URL: https://images.betanews.com/stylesheets/fileforum3/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.174 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 529ce545d0f689295a76134ae7f6add7b8b78904a15b6bef1a5a6bd0cb47b281

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://images.betanews.com/stylesheets/fileforum3/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
cf-cache-status: HIT
last-modified: Tue, 11 Jul 2017 23:30:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4524
etag: "563-5541315c69180"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Ct5%2FHSvXqZx%2FGLLegAjGHm%2BxpVZVip7bN72KcCHKFaXspW4M%2BufQz%2FTcTAWlR7M0mcdclQEjPzoGLZ9t2GY312TLm2dMb4TOQU%2FQcLsl5Rotri6wjbtYLjgFOkoHec6lEbQiS4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 859597bfada60e4f-MXP
content-length: 1379

GET
H2 200 ff_logo.png
images.betanews.com/fileforum3/header/ 4 KB
4 KB 117ms
117ms Image
image/png 104.26.12.174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.betanews.com/fileforum3/header/ff_logo.png
Requested by: Host: images.betanews.com
URL: https://images.betanews.com/stylesheets/fileforum3/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.174 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a8f59aaec3baa11914a42d01b1513778de352d807ced7c5a7296f21b97e1848

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://images.betanews.com/stylesheets/fileforum3/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
cf-cache-status: HIT
last-modified: Sat, 08 Jul 2017 02:49:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4524
etag: "f28-553c565bb7500"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NqkOD%2FjTDm8JS4s0mv%2BM5pfMx%2FxOKGNLe5jaa7SITbXK8HAhzEuVplNKRdgN9Vj2kcG11hSgAKALAlSwFJxQKY%2Fk%2FsxyRILKMOuwkz7ubh6cRtSKDYq0MZbw%2F7SPRMaw50ArQ80%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 859597bfada90e4f-MXP
content-length: 3880

GET
H2 200 buttons.png
images.betanews.com/fileforum3/buttons/ 12 KB
12 KB 119ms
118ms Image
image/png 104.26.12.174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.betanews.com/fileforum3/buttons/buttons.png
Requested by: Host: images.betanews.com
URL: https://images.betanews.com/stylesheets/fileforum3/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.174 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06f1ec52dea17ff1c6bed231b53938e5200586e1b37c6707f453b115454da806

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://images.betanews.com/stylesheets/fileforum3/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
cf-cache-status: HIT
last-modified: Sat, 08 Jul 2017 02:49:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4524
etag: "2ea3-553c565bb7500"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bdRbLolNI9xGZyyjbZzfhhQjUpbsy0FFQo0Lj0jCGnN7HHB%2FL9dj3u5VtSKNvU5cgJ%2B%2FF15ZNaC1XsAYiNHmn3S9TfzIgq59DhxR4%2FLG%2B8ilBTt79cmGHomtIn8%2B4jFZDGf0Mhg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 859597bfbdab0e4f-MXP
content-length: 11939

GET
H2 200 socialmedia_icons.png
images.betanews.com/fileforum3/ 5 KB
5 KB 127ms
126ms Image
image/png 104.26.12.174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.betanews.com/fileforum3/socialmedia_icons.png
Requested by: Host: images.betanews.com
URL: https://images.betanews.com/stylesheets/fileforum3/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.174 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71a2933a8805045e2305cbd2824ab3bcc1a371f1e6d111645ce14cd7c7c5bf7a

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://images.betanews.com/stylesheets/fileforum3/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
cf-cache-status: HIT
last-modified: Sat, 08 Jul 2017 02:49:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4524
etag: "123b-553c565bb7500"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DON0QYlJpHK3ef2Mzs0JrcawCVj7nDiLS2NEqv%2BQ5R%2BH7AaM74CzL20pTfSMfQzDpL8QFc%2BDY97lu7Dkt%2F4E8WfmZP29J5gwL%2FBMohbHF1Sr%2B9PS8gdm%2Bj%2F1NqzuP4zvSPE3W9U%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 859597bfbdac0e4f-MXP
content-length: 4667

GET
H2 200 navbar_active.png
images.betanews.com/fileforum3/header/ 192 B
604 B 129ms
128ms Image
image/png 104.26.12.174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.betanews.com/fileforum3/header/navbar_active.png
Requested by: Host: images.betanews.com
URL: https://images.betanews.com/stylesheets/fileforum3/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.174 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7087b3afc70c0f1a640c5327239e94a508b7a7751800b3952edf804a3837a2e8

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://images.betanews.com/stylesheets/fileforum3/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
cf-cache-status: HIT
last-modified: Sat, 08 Jul 2017 02:49:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1874
etag: "c0-553c565bb7500"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j2AX0t5kJvJb0aVS0sNv1uAaE%2F%2Bqyw2A0s1UXASbqIDv4dlyeCbS7KGJBWhDO%2FSDBsJbgJf2Xi6Vr0%2F%2Fj2V1uxsjOjgc3WqFW4hVu%2BM5aObBxCwCNnkf%2FznDqEMl1gQyrV5PCXI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 859597bfbdad0e4f-MXP
content-length: 192

GET
H2 200 bgs.png
images.betanews.com/fileforum3/ 4 KB
4 KB 125ms
124ms Image
image/png 104.26.12.174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.betanews.com/fileforum3/bgs.png
Requested by: Host: images.betanews.com
URL: https://images.betanews.com/stylesheets/fileforum3/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.174 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe00f6a25703ead073b6b2ce1a56c07fb5dcb6da14aa2c73a06dce0ffb90b9ab

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://images.betanews.com/stylesheets/fileforum3/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
cf-cache-status: HIT
last-modified: Sat, 08 Jul 2017 02:49:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4524
etag: "ec9-553c565bb7500"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fgApEOgV3fKrQMBfQAn5Goi0OnDTROXtT1Z9R%2F3rTd9g1VlNWJmNHJDDm9ZM2DKsvp0jBBwgWG3ZrO7qbewKA2Biq1F0jhNf%2BJa3MoCzoj6Pe4nSTLr7uexA4MafNll2zwIYkjg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 859597bfbdaf0e4f-MXP
content-length: 3785

GET
H2 200 icons2.png
images.betanews.com/fileforum3/icons/ 2 KB
2 KB 522ms
522ms Image
image/png 104.26.12.174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.betanews.com/fileforum3/icons/icons2.png
Requested by: Host: images.betanews.com
URL: https://images.betanews.com/stylesheets/fileforum3/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.174 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34de0b876686b5e0e70169241a272564f2813e26def4572b91e79af258ad3d89

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://images.betanews.com/stylesheets/fileforum3/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
cf-cache-status: MISS
last-modified: Sat, 08 Jul 2017 02:49:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "892-553c565bb7500"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kkD10J%2BqRTPQDZ7vkHp1h5%2F1qkcbEDRgCYGlUeeQPxqsWDjd1OhmhotUBd7pbtxWr8961uMquoBodC1EdhKCbAFtzJ%2FnLPs1Yd3IOj91ICCiEBHZH1JapxtlrgOZe8g97iZzqYo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 859597bfbdb00e4f-MXP
content-length: 2194

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/ 407 KB
138 KB 408ms
176ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6676241418785266

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

34ad89f6e61b0cb2a9c36f5eafcb2e0e84555cc7827885586a83aa1b5a2d8e6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141318
x-xss-protection: 0
server: cafe
etag: 187377084851239077
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Feb 2024 07:42:31 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240220/r20190131/ Frame D904 9 KB
5 KB 354ms
113ms Document
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240220/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6676241418785266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

age: 30686
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 23:11:05 GMT
etag: 3890843268177463596
expires: Wed, 06 Mar 2024 23:11:05 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 234 KB
82 KB 129ms
128ms Script
application/javascript 142.250.185.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-H9SLV28721&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WHTWSXS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

3bdced3a3ce2d6a91489eddb8b904b96a2220d406e550a56bc7cb52ba732e0f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:30 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 84095
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 22 Feb 2024 07:42:30 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
252 B 350ms
118ms Ping
text/plain 142.250.181.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-H9SLV28721&gtm=45je42h0v9110113147z89119310666za200&_p=1708587750289&gcd=13l3l3l3l1&npa=0&dma=0&cid=1928486355.1708587751&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1708587751&sct=1&seg=0&dl=https%3A%2F%2Ffileforum.com%2Fprofile%2Fnurseraven8%2F&dt=nurseraven8%27s%20Profile%20%7C%20FileForum&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2035
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-H9SLV28721&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.181.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://fileforum.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E1D1 326 KB
76 KB 523ms
522ms Document
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6676241418785266&output=html&adk=1812271804&adf=3025194257&lmt=1708587749&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=260x1080_l%7C260x1080_r&format=0x0&url=https%3A%2F%2Ffileforum.com%2Fprofile%2Fnurseraven8%2F&pra=5&wgl=1&easpi=0&asro=0&aseiel=1~2~4~6~7&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708587750769&bpp=19&bdt=966&idt=675&shv=r20240220&mjsv=m202402150101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1396509222195&frm=20&pv=2&ga_vid=1928486355.1708587751&ga_sid=1708587751&ga_hid=1996822779&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31081152%2C42531706%2C95324581%2C95325069%2C95322181%2C95324155%2C95324161%2C95324435&oid=2&pvsid=2418963826889958&tmod=667275704&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=700

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

a4f8fdc9c6512ce6b72982e86467c139b976bbe1de224fbc7360318347f6c56e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 77838
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 Feb 2024 07:42:31 GMT
expires: Thu, 22 Feb 2024 07:42:31 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F519 101 KB
43 KB 640ms
640ms Document
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6676241418785266&output=html&h=280&adk=3368998127&adf=2550651363&pi=t.aa~a.3269266735~rp.4&w=659&fwrn=4&fwrnh=100&lmt=1708587749&rafmt=1&to=qs&pwprc=8797158495&format=659x280&url=https%3A%2F%2Ffileforum.com%2Fprofile%2Fnurseraven8%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708587750788&bpp=2&bdt=985&idt=685&shv=r20240220&mjsv=m202402150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=1396509222195&frm=20&pv=1&ga_vid=1928486355.1708587751&ga_sid=1708587751&ga_hid=1996822779&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=310&ady=344&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31081152%2C42531706%2C95324581%2C95325069%2C95322181%2C95324155%2C95324161%2C95324435&oid=2&pvsid=2418963826889958&tmod=667275704&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=688

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

c35a031333f6e54a39fd4dc1752ff62d9f79fbaa7e23aa047589a3d1b02c0978

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 43440
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 Feb 2024 07:42:31 GMT
expires: Thu, 22 Feb 2024 07:42:31 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/ 166 KB
56 KB 159ms
159ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

c1c660d891e88b1989e6ee7da95952e4681461f599a0eb4927a49aa90c7dccc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:32 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57363
x-xss-protection: 0
server: cafe
etag: 16616390158741120268
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Feb 2024 07:42:32 GMT

GET
H2 200 ca-pub-6676241418785266 Show response
fundingchoicesmessages.google.com/i/ 182 KB
61 KB 424ms
150ms Script
application/javascript 142.250.185.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-6676241418785266?ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

ESF /

Resource Hash

104c2ae6d04ed58367e47b13fd44c82071d1f6e0ff441ddc41555c7689ad6126

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BLKXnVBKKZD6bUNmiXNheg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:32 GMT
content-security-policy: script-src 'report-sample' 'nonce-BLKXnVBKKZD6bUNmiXNheg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjmsKoxSXF4KYhxXDy1m2mi0B83ukO03UgvqjylOkmENcyPGNqBeIH4c-YXgCxgcZzJgsgZvzzgokTiN99ecnE8fUlkwQQqwHxO8lXTN-AeIePBwvfuumsKkCsuX46ayAQxzyfzpoCxItZZ7CuBmKn9BmsAUD8OXMG628g9qmfwRoFxEI8HC--3l7HJrBi7YUPjACC_0Xl"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DD30 624 B
246 B 150ms
150ms Document
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPeRExCMr4DzBRi5q6GIAjAB&v=APEucNXR9NRkQp9PNGXVwFyKxqIQipX5AGlnHotQ2P2Ciabsk8cgVcQnuAqDbF5Lcz6zc1IAU8YtQcBPg6XeaZmiAOFE0rSvpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6676241418785266&output=html&h=280&adk=3368998127&adf=2550651363&pi=t.aa~a.3269266735~rp.4&w=659&fwrn=4&fwrnh=100&lmt=1708587749&rafmt=1&to=qs&pwprc=8797158495&format=659x280&url=https%3A%2F%2Ffileforum.com%2Fprofile%2Fnurseraven8%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708587750788&bpp=2&bdt=985&idt=685&shv=r20240220&mjsv=m202402150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=1396509222195&frm=20&pv=1&ga_vid=1928486355.1708587751&ga_sid=1708587751&ga_hid=1996822779&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=310&ady=344&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31081152%2C42531706%2C95324581%2C95325069%2C95322181%2C95324155%2C95324161%2C95324435&oid=2&pvsid=2418963826889958&tmod=667275704&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=688

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6676241418785266&output=html&h=280&adk=3368998127&adf=2550651363&pi=t.aa~a.3269266735~rp.4&w=659&fwrn=4&fwrnh=100&lmt=1708587749&rafmt=1&to=qs&pwprc=8797158495&format=659x280&url=https%3A%2F%2Ffileforum.com%2Fprofile%2Fnurseraven8%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708587750788&bpp=2&bdt=985&idt=685&shv=r20240220&mjsv=m202402150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=1396509222195&frm=20&pv=1&ga_vid=1928486355.1708587751&ga_sid=1708587751&ga_hid=1996822779&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=310&ady=344&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31081152%2C42531706%2C95324581%2C95325069%2C95322181%2C95324155%2C95324161%2C95324435&oid=2&pvsid=2418963826889958&tmod=667275704&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=688
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 Feb 2024 07:42:32 GMT
expires: Thu, 22 Feb 2024 07:42:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/ Frame 80B2 23 KB
9 KB 158ms
157ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/abg_lite_fy2021.js

Requested by

Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 13:46:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64583
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 13:46:09 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/ Frame 80B2 8 KB
3 KB 161ms
160ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:34:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 472
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 07 Mar 2024 07:34:40 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 80B2 0
0 403ms
155ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstzAnfWOGWb8LJ1TJpbUC27-l7MJ4js8vwrZzbKT6SoVvLOiQOCkmTqKaIKoL6cfyV_0s69x42dAM2nEjj6S9md6f02-Y9meOSyFKttfQjfv9OhYmUIfuIzX5UjDVLpczfMG3ETrF2UXSWsBCN74Q1nJxkfDVs7sj9_O65ApEIQhMUhNzrbDpCinzZ2P8xJaag3ZrLvkRZ_MIRlteJuxl8Y25y4cWR-TQS1jTBdj_rxiFlSJgm-N08Y00uVQIwBH02gwc1wjCB3-jeSIaisPp5FBXgG3nQxWp65gQusKFuuA40MTDVXW3Mf9hyPrfW-0IdZ3FFFLvkp2Gm8teadCjQ8roQs1W-jYDm1__HY9zmipqD3MCrhJeNICW4mAPsjlIaD9st_KBqx84PmFvJHZ7Z0NSsg5PJm5yzwUuCMHAnWCdOSSDCZHAHWbauUHlxCWD3QccoeHBIbQQ_jM0uPLNA3HiDuXTqsEZwMCgWM77YTRKoKvs3WzhiykzauIcfKNIeb-Q_ydwPU0rZQxuAWnGr9S4YjtfXx-OQx1O2cf6Kvn3Kt1vGmRLNFlKDsLeQb66LPVLW-VXeHFnAViVQYGm2VOna2IytlrOzkv8idhUl4rut7O2kIHB7MdMh1wkhc7fnM8TRsHCGvg03i3JLJ5te5JZw19Awv6LgxmGPsbS-RqtKDWWGnF7bYG6e9fZbI8KCDF-yjuxDzQarTpiPa2YPhlRk9oGUYj6PkLwCsUp5IQ6br2sPspj5WAsodS7zWn3h8t8JGtcBnjIqFQUsBoc6Uxnsxpd6EeuxdwBgNuqsB-oaVPYdRp-z7mUX9vQd1yyfM1o2TdpGTXoH5RCDtpUy3DZiidJgnw6KRKGkgymF0il_Wrat8yaWsoBQLVgv9SemtpqhQbRx6UcZA2ePCGPA3i3tTtkCf4XbxgVgFpkWE1FpGul6WoStlWxkzGIQPSEcyRLvk6FBC_Tv2Q7_7yv3jGQhqldDfZDenCOlk8t7LW-FJ1Ty-AJmFe9wieqYq5lL47Y2nFLjjBBlsJF6TMg6F_rUjssrLIuW6i8wIzDuOpixP0HJfUc_ZP1GFz6btYurMaXSEs4LySHivadVwBrRZXMGu4mewxg9FYmIosgEBmQIxP0UYV8xJ61HwupV4D6DL2GQI31RtMtB4eWdl3bAn1uQ7QM2qhaf8nmEGJGHwHB8Cw-wIAzQFlVjT5L_D93nQtKi5QhTEuE47IXeNJT_pjmGMlFqTUbCC42hJiG7YXe7KcewzuRwhVhZFrpGQVXoNsl7wwtCUUL_odhmSommmk_boWDV7znGB7KlkNr289x18XE6EbdnB_evx8_g_lJJFaQrHy0onvYUBTFsFbUbG3gzRZJMvGu_viEE74RJjUqchHOZq6QpVG-s&sai=AMfl-YTT1GK_5pIoJfkJIIbdaLjFUDyPDk2yvw9_1XB2meRcCBpb6tPxZrm5PwidX1imlQYnerpMcWuC5Dmb7f9rlY3h-au47aIIEgxnwllvIuppqo9aX17yQFp33hPDra44B60tg18qHQ07DrTC5-obcTTDy4QGf72kPKwk4qgDCamakKhx18yLSUa4CzMeIcjwh5AQoa2hsh4-f7jaJg2xxoszWKk2xOPqdFziX026QJvgxewofiqapp5ACgJwP4JlM_sWewUSlPbk_MR-hDpy2plkULwoefC7TJwcZPjRowIpvIBKO0s-l-bIvrxY_F-PhR7Mooz5U8iLcoy4SQmqEvrKLiHkqtDD2nJHlN02-gJxDcFfiRgf_pmlbKt37TL5CQWsZrIywdger6YX1d8plzOec3jkAQAGIhkUE554WnnCHTauUMWwZgJ-2LuBtbarisKeJ8Zr4CgFY0p0snKpc24gXf_FhB1KdBX1tDB2fQ6Xx7ntd5Tk7Do&sig=Cg0ArKJSzBU1V9Ny6aOzEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20240215.92038&arae=0&ftch=1&adurl=

Requested by

Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 22 Feb 2024 07:42:32 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 22 Feb 2024 07:42:32 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 80B2 41 KB
14 KB 360ms
122ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:46:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 86138
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Feb 2025 07:46:54 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 80B2 3 KB
1 KB 416ms
179ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 15:14:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 59297
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 15:14:15 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 80B2 20 KB
8 KB 349ms
112ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 16:59:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52991
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 16:59:21 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 80B2 204 KB
61 KB 115ms
115ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

48639bd7695fc270e23859d9b74231f49bc78f05e3a96ed0332a9b0b80d8c2e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:28:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62854
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 22 Feb 2024 08:28:31 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 80B2 42 B
63 B 159ms
159ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BIqYMM6pVJvGxao8jYkIQASR56Izj_VeF7T4IKYYmachk04AszKn6b0o2enNdx0XhdyMeDXkG8lWvcfQyVUqYPakTmfu9lwpqnR8JfKZnXmBjhBhk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 17681561713314640743
s0.2mdn.net/simgad/ Frame 80B2 74 KB
75 KB 370ms
117ms Image
image/jpeg 172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17681561713314640743

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f6.1e100.net

Software

sffe /

Resource Hash

3aaef75f011d2fc74f34f5f5885321eba4bf4dedab3e1eb4be78d1fee4da3cc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

expires: Wed, 19 Feb 2025 15:25:59 GMT
date: Tue, 20 Feb 2024 15:25:59 GMT
x-content-type-options: nosniff
age: 144993
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75765
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 15:04:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DD30
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF1mY0RXOIqx5_Axr6Xfo6A&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF1mY0RXOIqx5_Axr6Xfo6A&google_cver=1&C=1

43 B
773 B

380ms
380ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF1mY0RXOIqx5_Axr6Xfo6A&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPeRExCMr4DzBRi5q6GIAjAB&v=APEucNXR9NRkQp9PNGXVwFyKxqIQipX5AGlnHotQ2P2Ciabsk8cgVcQnuAqDbF5Lcz6zc1IAU8YtQcBPg6XeaZmiAOFE0rSvpg
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:33 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NTWr821K1f%2FwbAuU40kO6AT%2BQJM3zaeUm0gmCzRr5BP2NfY9DmiXUpFlVObMy%2Bc7I8lFC6%2BWFC2blbqY8nLuQK6wDkkrhnwqUXcWrRG%2BHfcQmnPKeq%2FwhoGOLgMnwmViHtaVw9roJzLIVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 859597d07b82e3e7-TLV
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v7DpgoK2PxfHhAwzROBEystD8HOiJ5RXQiAOvY0D6HbIBb4G%2F0TlEAi8ZBqyxiz5ZNAQwvW6e5mPnDfYwsuIeJ3Y%2FQFYMRWcKYFz0i3bfgwwdci6ArTCBgOTJ5hjh%2F1MUoyWMiLgyDerHg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEF1mY0RXOIqx5_Axr6Xfo6A&google_cver=1&C=1
cache-control: no-cache
cf-ray: 859597cea846e3cf-TLV
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DD30
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zdb66IsFVsMAAFM4AGzo0AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENywz3Wk8-aU5rXCHGmf6XY&google_cver=1

43 B
739 B

443ms
443ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENywz3Wk8-aU5rXCHGmf6XY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPeRExCMr4DzBRi5q6GIAjAB&v=APEucNXR9NRkQp9PNGXVwFyKxqIQipX5AGlnHotQ2P2Ciabsk8cgVcQnuAqDbF5Lcz6zc1IAU8YtQcBPg6XeaZmiAOFE0rSvpg
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:33 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l72PAyz4Nzzt%2FEh6e5H81gL03JCHw%2BX4VzrF%2F8UXkhTXnAGLKsia5xErASwQ4sd%2FoxgXzCyYe2NaO6goe%2FQJDO%2F5OaHdbOKNmUMJ5oDfTmk%2BVog94nlk9a%2B9reejo81jzWtcZTKHRK%2Bv7A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 859597d1be17e3e7-TLV
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:33 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENywz3Wk8-aU5rXCHGmf6XY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame DD30
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJUF9euv9u6-MXX6zoa4hz0&google_cver=1

43 B
1 KB

117ms
116ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEJUF9euv9u6-MXX6zoa4hz0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPeRExCMr4DzBRi5q6GIAjAB&v=APEucNXR9NRkQp9PNGXVwFyKxqIQipX5AGlnHotQ2P2Ciabsk8cgVcQnuAqDbF5Lcz6zc1IAU8YtQcBPg6XeaZmiAOFE0rSvpg

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:32 GMT
an-x-request-uuid: 243c70e3-950c-4379-94cc-f7634bc731d6
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 31.187.78.153; 31.187.78.153; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEJUF9euv9u6-MXX6zoa4hz0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame DD30
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjMzNTkyMzAxMTMwNjI0OTY2MQ%3D%3D

170 B
243 B

122ms
121ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjMzNTkyMzAxMTMwNjI0OTY2MQ%3D%3D

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:32 GMT
an-x-request-uuid: e4a68680-a93f-4896-b728-39d891f424a3
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjMzNTkyMzAxMTMwNjI0OTY2MQ%3D%3D
x-proxy-origin: 31.187.78.153; 31.187.78.153; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 80B2 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: acedd99a00a765ea62d82ebda52b76f72cc58fbb736a5f7b0154d519ce85f4ec

Request headers

accept-language: he-IL,he;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 80B2 0
0 147ms
146ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstzAnfWOGWb8LJ1TJpbUC27-l7MJ4js8vwrZzbKT6SoVvLOiQOCkmTqKaIKoL6cfyV_0s69x42dAM2nEjj6S9md6f02-Y9meOSyFKttfQjfv9OhYmUIfuIzX5UjDVLpczfMG3ETrF2UXSWsBCN74Q1nJxkfDVs7sj9_O65ApEIQhMUhNzrbDpCinzZ2P8xJaag3ZrLvkRZ_MIRlteJuxl8Y25y4cWR-TQS1jTBdj_rxiFlSJgm-N08Y00uVQIwBH02gwc1wjCB3-jeSIaisPp5FBXgG3nQxWp65gQusKFuuA40MTDVXW3Mf9hyPrfW-0IdZ3FFFLvkp2Gm8teadCjQ8roQs1W-jYDm1__HY9zmipqD3MCrhJeNICW4mAPsjlIaD9st_KBqx84PmFvJHZ7Z0NSsg5PJm5yzwUuCMHAnWCdOSSDCZHAHWbauUHlxCWD3QccoeHBIbQQ_jM0uPLNA3HiDuXTqsEZwMCgWM77YTRKoKvs3WzhiykzauIcfKNIeb-Q_ydwPU0rZQxuAWnGr9S4YjtfXx-OQx1O2cf6Kvn3Kt1vGmRLNFlKDsLeQb66LPVLW-VXeHFnAViVQYGm2VOna2IytlrOzkv8idhUl4rut7O2kIHB7MdMh1wkhc7fnM8TRsHCGvg03i3JLJ5te5JZw19Awv6LgxmGPsbS-RqtKDWWGnF7bYG6e9fZbI8KCDF-yjuxDzQarTpiPa2YPhlRk9oGUYj6PkLwCsUp5IQ6br2sPspj5WAsodS7zWn3h8t8JGtcBnjIqFQUsBoc6Uxnsxpd6EeuxdwBgNuqsB-oaVPYdRp-z7mUX9vQd1yyfM1o2TdpGTXoH5RCDtpUy3DZiidJgnw6KRKGkgymF0il_Wrat8yaWsoBQLVgv9SemtpqhQbRx6UcZA2ePCGPA3i3tTtkCf4XbxgVgFpkWE1FpGul6WoStlWxkzGIQPSEcyRLvk6FBC_Tv2Q7_7yv3jGQhqldDfZDenCOlk8t7LW-FJ1Ty-AJmFe9wieqYq5lL47Y2nFLjjBBlsJF6TMg6F_rUjssrLIuW6i8wIzDuOpixP0HJfUc_ZP1GFz6btYurMaXSEs4LySHivadVwBrRZXMGu4mewxg9FYmIosgEBmQIxP0UYV8xJ61HwupV4D6DL2GQI31RtMtB4eWdl3bAn1uQ7QM2qhaf8nmEGJGHwHB8Cw-wIAzQFlVjT5L_D93nQtKi5QhTEuE47IXeNJT_pjmGMlFqTUbCC42hJiG7YXe7KcewzuRwhVhZFrpGQVXoNsl7wwtCUUL_odhmSommmk_boWDV7znGB7KlkNr289x18XE6EbdnB_evx8_g_lJJFaQrHy0onvYUBTFsFbUbG3gzRZJMvGu_viEE74RJjUqchHOZq6QpVG-s&sai=AMfl-YTT1GK_5pIoJfkJIIbdaLjFUDyPDk2yvw9_1XB2meRcCBpb6tPxZrm5PwidX1imlQYnerpMcWuC5Dmb7f9rlY3h-au47aIIEgxnwllvIuppqo9aX17yQFp33hPDra44B60tg18qHQ07DrTC5-obcTTDy4QGf72kPKwk4qgDCamakKhx18yLSUa4CzMeIcjwh5AQoa2hsh4-f7jaJg2xxoszWKk2xOPqdFziX026QJvgxewofiqapp5ACgJwP4JlM_sWewUSlPbk_MR-hDpy2plkULwoefC7TJwcZPjRowIpvIBKO0s-l-bIvrxY_F-PhR7Mooz5U8iLcoy4SQmqEvrKLiHkqtDD2nJHlN02-gJxDcFfiRgf_pmlbKt37TL5CQWsZrIywdger6YX1d8plzOec3jkAQAGIhkUE554WnnCHTauUMWwZgJ-2LuBtbarisKeJ8Zr4CgFY0p0snKpc24gXf_FhB1KdBX1tDB2fQ6Xx7ntd5Tk7Do&sig=Cg0ArKJSzBU1V9Ny6aOzEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=514&vt=11&dtpt=513&dett=2&cstd=0&cisv=r20240215.92038&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 5861 38 KB
13 KB 112ms
112ms Document
text/html 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

accept-ranges: bytes
age: 85598
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 07:55:54 GMT
expires: Thu, 20 Feb 2025 07:55:54 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/ Frame D2F8 9 KB
4 KB 113ms
113ms Document
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

age: 52363
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 17:09:49 GMT
etag: 3890843268177463596
expires: Wed, 06 Mar 2024 17:09:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/ Frame 6A70 9 KB
4 KB 112ms
112ms Document
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

age: 52363
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 17:09:49 GMT
etag: 3890843268177463596
expires: Wed, 06 Mar 2024 17:09:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxUAy8jBYzawUELd8DQurmP5VqEtgBlog9hvUt7eSDXuqoWbh_RyQt67htXOtt39gquNuOKQYj_hhhEf67kk_fFdZm-JG3_uV6yD0wsD79Md8aKc1v0VJwz-PVHQUJkBNC5icU4enw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 160ms
159ms Script
application/javascript 142.250.185.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUAy8jBYzawUELd8DQurmP5VqEtgBlog9hvUt7eSDXuqoWbh_RyQt67htXOtt39gquNuOKQYj_hhhEf67kk_fFdZm-JG3_uV6yD0wsD79Md8aKc1v0VJwz-PVHQUJkBNC5icU4enw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA4NTg3NzUyLDc3NjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9maWxlZm9ydW0uY29tL3Byb2ZpbGUvbnVyc2VyYXZlbjgvIixudWxsLFtbOCwiMmJiZldyVzU4cHciXSxbOSwiaXciXSxbMTgsIltbWzBdXV0iXSxbMjAsIltudWxsLG51bGwsWzk1MzIyOTAwXSwxMSwxM10iXSxbMTksIjIiXSxbMTcsIlswXSJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.iw.2bbfWrW58pw.es5.O/am=wA/d=1/rs=AJlcJMxIIPwfMZXlO5lU3MnkTuPu9C1s3g/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

ESF /

Resource Hash

78443af85ee16512679e682844ffcaa43ea42224c25ed61f6cedafcb76d63581

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-LwZ6gY9Xp60EQHcQl2nqQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:32 GMT
content-security-policy: script-src 'report-sample' 'nonce-LwZ6gY9Xp60EQHcQl2nqQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzj6mHU4pJiCNaQYjjvdIfpOhBfVHnKdBOIaxmeMbUC8YPwZ0wvgNhA4zmTBRAz_nnBxAnE7768ZOL4-pJJAojVgPid5Cumb0C8w8eDhW_ddFYVINZcP501EIhjnk9nTQHixawzWFcDsVP6DNYAIP6cOYP1NxD71M9gjQJiIR6OF19vr2MTmPFozSJmAIHaQJc"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 BoEj1MRYnOy5BSN5ElbJySd6MGFyYBWT_ZtkFEIAVvM.js Show response
pagead2.googlesyndication.com/bg/ Frame 5861 39 KB
15 KB 115ms
115ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BoEj1MRYnOy5BSN5ElbJySd6MGFyYBWT_ZtkFEIAVvM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

068123d4c4589cecb90523791256c9c9277a306172601593fd9b6414420056f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:28:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 841
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15302
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 17:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 21 Feb 2025 07:28:31 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame D2F8 5 KB
1 KB 359ms
122ms Stylesheet
text/css 142.250.186.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f10.1e100.net

Software

ESF /

Resource Hash

47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 22 Feb 2024 07:42:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 07:01:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 22 Feb 2024 07:42:33 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D2F8 205 B
295 B 352ms
112ms Image
image/png 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:46:35 GMT
x-content-type-options: nosniff
age: 86158
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 20 Feb 2025 07:46:35 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D2F8 604 B
1 KB 352ms
111ms Image
image/png 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:33:08 GMT
x-content-type-options: nosniff
age: 86965
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 20 Feb 2025 07:33:08 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/ Frame D2F8 15 KB
6 KB 112ms
112ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

cafe /

Resource Hash

0e33434b042c688fa1972d51e9c103fe592fca7a4dd50358c08449c7b0f5cb4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 19:34:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 43663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6487
x-xss-protection: 0
server: cafe
etag: 9214289930287671984
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 19:34:49 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/ Frame D2F8 22 KB
9 KB 118ms
118ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

cafe /

Resource Hash

716b2a35acfc8e6a247c9e4d9e3c32dc2354b3a8a6e6481835a64b783a5ba4a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 17:08:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52438
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9141
x-xss-protection: 0
server: cafe
etag: 6041988417631582345
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 17:08:34 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/ Frame 6A70 23 KB
9 KB 112ms
111ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 15:14:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 59297
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 15:14:15 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 6A70 9 KB
846 B 334ms
123ms Stylesheet
text/css 142.250.186.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f10.1e100.net

Software

ESF /

Resource Hash

d3f4104957e76483acba4180738253208fd8d4d81c64931244860514af502b82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 22 Feb 2024 07:42:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 07:32:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 22 Feb 2024 07:42:33 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240216_RC00/ Frame 6A70 15 KB
3 KB 349ms
112ms Stylesheet
text/css 142.250.185.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240216_RC00/outstream.min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f10.1e100.net

Software

sffe /

Resource Hash

425f9ca7029ca2c95d204079575a3e5f737ef4d322614225344c5aeadd51bfb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:37:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 86692
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2939
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 16:58:05 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Feb 2025 07:37:41 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240216_RC00/ Frame 6A70 379 KB
132 KB 353ms
116ms Script
text/javascript 142.250.185.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240216_RC00/outstream.min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f10.1e100.net

Software

sffe /

Resource Hash

5ea0a2bf2e4ba86815782535de2bf697c77611dc7bf30a709bc9220aa21c0c00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:31:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87088
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 134652
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 16:58:05 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Feb 2025 07:31:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 6A70 20 KB
8 KB 118ms
118ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 16:59:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52991
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 16:59:21 GMT

GET
H2 200 AGSKWxUXmXcYOXtbFPdnxURWDyHmqk2K0QRkm0-5nLP1oQ8lFbtAE2kpv4XNxKnQfy5jgbUMprHPsU29jg5OyorTvfIO4eve0kIJggKHq6YzBBZxT9U4Uy2nLS1rXWDX6IF9xDcwbXE61g== Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 171ms
171ms Script
application/javascript 142.250.185.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUXmXcYOXtbFPdnxURWDyHmqk2K0QRkm0-5nLP1oQ8lFbtAE2kpv4XNxKnQfy5jgbUMprHPsU29jg5OyorTvfIO4eve0kIJggKHq6YzBBZxT9U4Uy2nLS1rXWDX6IF9xDcwbXE61g==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA4NTg3NzUyLDk0MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vZmlsZWZvcnVtLmNvbS9wcm9maWxlL251cnNlcmF2ZW44LyIsbnVsbCxbWzgsIjJiYmZXclc1OHB3Il0sWzksIml3Il0sWzE4LCJbW1swXV1dIl0sWzIwLCJbbnVsbCxudWxsLFs5NTMyMjkwMF0sMTEsMTNdIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

ESF /

Resource Hash

7dd237402d268d06f429c8c5101ea5432a2e5c188be7470a5b0413ba17b856ac

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-oIn9MyLImmzwFfw8cahE-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:33 GMT
content-security-policy: script-src 'report-sample' 'nonce-oIn9MyLImmzwFfw8cahE-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzj6mHU4pJiCNKQYjjvdIfpOhBfVHnKdBOIaxmeMbUC8YPwZ0wvgNhA4zmTBRAz_nnBxAnE7768ZOL4-pJJAojVgPid5Cumb0C8w8eDhW_ddFYVINZcP501EIhjnk9nTQHixawzWFcDsVP6DNYAIP6cOYP1NxD71M9gjQJiIW6Ol19vr2MTmLB0miQAPyA_rw"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5861 0
20 B 148ms
148ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BbS8T5_rWZa7jJNv1xtYPkI-joAoAAAAAOAHgBAI&bg=!7u2l7aLNAAZ3BdUuVwU7ADQBe5WfOMUF9I3SFPosTGb8Ljq8jBjbKA3rFJbWLFInhqMSCszz4XoNT5nONIm4QRHTzWISAgAAAEdSAAAAAmgBB5kDCDqMI9XXo8AwEnXBbHKcnxGffv9_PJxQifvZleVwl3ckCne-yaa9M65CJI_9AvqbP4gYOBcxhZ80B0yBvN3_vmFeSP1EuxLhoBYVMYl-vMa89NE4sbjoB16__klgXbUjRlA7YSiSziKnbbAZQ53CJ8Vm-7bs0Sy7M0tkn_9wy8ODOjlqwnoPJevFGkGCVSZWtz0PnpyqVlUhLtSVJsSHto79egu_Wx3f9lomskcrhbilWbZ3GuPgcU1SnIBHjKzdvzRyD3xBB3r7O6WljDouf1qiVJN55P5c7DBJH0QbDNAup0ncmXiWCT0mAtJupRFvhMin0S9712WVA61OUfpBV2WHnle-Inmns0kwG8ERIuU-Nv8wAKBMfSCNll4nol6WjeeMiLguECBfpyEpepntXzFNTsPLWosNBTU8OOkOUPjhDl2SbbbEL3gutKuuN1v93Fh0gtRp8Y86FENeM81Ey8H_9HGzO9bpF5vPYUqdjXd6jrcONezrEdpvQdVpFrkxqqxHRv4D7FthOemqSM3-9rLbA1DMYhTHbe7Lm6bb-X6MY1GeMQslXVnirBROJViCJen1PpZud3O16z31uKokq-d838d4CmPhdYSJnE_DxmV5QYwNowLJm0ic7_pUp1uaOiTaOIa_64H0QKzeyDtbvKpwHamzduKxwaGhnITrBKmL9nffO9sDHvG2Sg-B5aaBDj5pbYYlGYOBHZfKW3UqyF7_KSNhkNSHvmFXS7g2kCbkM578DUL0CB2AbXHKmjE8y9gAJ-9COuIj9JvmlhvYMEcUB-OoKlBWmwjQCL-Hv1PERZu0cWQ-NnUh3-B-VhqxNGBlBR59j1mcnQvQTGn6pOwjmJfI33N3l9h3DroOsM2TYRHNBUwiM4MvOBeMwlTKJN5YJ7wO1_XZdFnzA6VlAXuVyovpO4e6sdcT_uVD65nrsGpT9lr6--7nDh8xZAlTEwcF3VUPbFFcBiD0FinQ6ukZDBIBKY-shF1at9E3ByrBU1vP8qYME0COlJ9zDzWvbmcUYrfm1hUZ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 78F6 14 KB
1 KB 122ms
121ms Stylesheet
text/css 142.250.186.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f10.1e100.net

Software

ESF /

Resource Hash

a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 22 Feb 2024 07:42:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 22 Feb 2024 05:43:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 22 Feb 2024 07:42:33 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 78F6 2 KB
822 B 115ms
115ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 16:59:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52992
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 16:59:21 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/ Frame 78F6 23 KB
9 KB 116ms
115ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 15:14:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 59298
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 15:14:15 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0A21 143 B
166 B 114ms
113ms Document
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

age: 3504
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 Feb 2024 06:44:09 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 78F6 3 KB
1 KB 116ms
114ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 15:14:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 59298
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 15:14:15 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 78F6 20 KB
8 KB 119ms
117ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 16:59:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52992
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 16:59:21 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 78F6 204 KB
61 KB 117ms
116ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

48639bd7695fc270e23859d9b74231f49bc78f05e3a96ed0332a9b0b80d8c2e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:28:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 842
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62854
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 22 Feb 2024 08:28:31 GMT

GET
H2 200 c0f9635aabdd33ab086e3930fa461563.js Show response
www.gstatic.com/mysidia/ Frame 78F6 36 KB
15 KB 113ms
111ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c0f9635aabdd33ab086e3930fa461563.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

0bd3e64a75f43409aa3141f35c5d1bd599773aec49d61aaa02522dbe6101c247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:39:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 86577
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15250
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 19:17:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 21 May 2024 07:39:36 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0A21
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

122ms
121ms

Document
text/html

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 Feb 2024 07:42:33 GMT
expires: Thu, 22 Feb 2024 07:42:33 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 Feb 2024 07:42:33 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
www.google-analytics.com/g/ 0
54 B 119ms
118ms Ping
text/plain 142.250.181.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-H9SLV28721&gtm=45je42h0v9110113147za200&_p=1708587750289&gcd=13l3l3l3l1&npa=0&dma=0&cid=1928486355.1708587751&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=AEI&_s=2&sid=1708587751&sct=1&seg=0&dl=https%3A%2F%2Ffileforum.com%2Fprofile%2Fnurseraven8%2F&dt=nurseraven8%27s%20Profile%20%7C%20FileForum&en=ad_impression&ep.query_id=CO7ygbC5voQDFdu60QQdkMcIpA&_et=1657&tfd=4375
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-H9SLV28721&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.181.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://fileforum.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6A70 0
45 B 1247ms
411ms Ping
image/gif 142.251.12.120

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~lswx180g&c=7881342935905&slotId=3940671467952.5&qqid=CKPUgbC5voQDFWEBTwgdisIL9A&fb=outstream-lima&sei=44752538%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730425%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240216_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.12.120 -, , ASN (),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:34 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6A70 15 KB
16 KB 348ms
116ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:38:45 GMT
x-content-type-options: nosniff
age: 86628
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Feb 2025 07:38:45 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6A70 5 KB
6 KB 417ms
187ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

4ec57f2a80b91090971b83970230ca09ab3568c5f5b224896ca9aa6180a76aa9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:29:28 GMT
x-content-type-options: nosniff
age: 87185
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5548
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Feb 2025 07:29:28 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6A70 15 KB
15 KB 367ms
137ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:30:26 GMT
x-content-type-options: nosniff
age: 87127
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Feb 2025 07:30:26 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6A70 0
20 B 148ms
147ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=Chl4d5_rWZePEJOGCvPIPioWvoA_7__DEday0rZz5EeSsjKLEPRABINnfigNg-br0g5wQoAH_8afcKcgBBakCXkdUgKhFkj6oAwHIA5sEqgSjAk_Q_1rMxB7D4B4HIvrlLXZ_ZsQ__RLMDmgcdf9ZV0TtR5ftZEjyG4ulWdoqqxKMqC4yx3BT4oyfJ9e-H_q1kkAsph3jFbd5gp4qIFFY1ZoCCDVclLDccZb6Wy7j_ahCyn7xJ1BZD_11DhRyzGwYU-E1fHjffOSv1NT7CKAC9UUXwMIS4CFWZQ5op8hHCy2gmqEpeH0_YGvIsHLzoJ_Kl0x7atrxTZ1ddSlA31VmfjmwqNQEFCBqTkPhSTKoZ2Mr8CJkHl92UqVRCdEO7myuWciNTgGoWeMVrIueBNTH2GSk7ndk-p4EbBel3k9tP7q6SZqXfxLn3O0FBhJO2G8ffdC4Xq90MCV_zt_7quzve0ErBfNj3QZD0-dvFQW5JWusd9urYsAEhsGb_7wE4AQDiAX9vN22S5AGAaAGdoAH_6n4uwSoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAfgvbECqAf_nrECqAffn7EC2AcA0ggkCIBhEAEYHzICigI6CYBAgMCAgICACEi9_cE6WJCg_q-5voQDgAoByAsB4AsBgAwBqg0CSUywE7ifuRbIE52ileMD2BMKiBQI2BQB0BUB-BYBgBcB6BcF&eventType=clickstring&clientTime=1708587753436&ai=Chl4d5_rWZePEJOGCvPIPioWvoA_7__DEday0rZz5EeSsjKLEPRABINnfigNg-br0g5wQoAH_8afcKcgBBakCXkdUgKhFkj6oAwHIA5sEqgSjAk_Q_1rMxB7D4B4HIvrlLXZ_ZsQ__RLMDmgcdf9ZV0TtR5ftZEjyG4ulWdoqqxKMqC4yx3BT4oyfJ9e-H_q1kkAsph3jFbd5gp4qIFFY1ZoCCDVclLDccZb6Wy7j_ahCyn7xJ1BZD_11DhRyzGwYU-E1fHjffOSv1NT7CKAC9UUXwMIS4CFWZQ5op8hHCy2gmqEpeH0_YGvIsHLzoJ_Kl0x7atrxTZ1ddSlA31VmfjmwqNQEFCBqTkPhSTKoZ2Mr8CJkHl92UqVRCdEO7myuWciNTgGoWeMVrIueBNTH2GSk7ndk-p4EbBel3k9tP7q6SZqXfxLn3O0FBhJO2G8ffdC4Xq90MCV_zt_7quzve0ErBfNj3QZD0-dvFQW5JWusd9urYsAEhsGb_7wE4AQDiAX9vN22S5AGAaAGdoAH_6n4uwSoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAfgvbECqAf_nrECqAffn7EC2AcA0ggkCIBhEAEYHzICigI6CYBAgMCAgICACEi9_cE6WJCg_q-5voQDgAoByAsB4AsBgAwBqg0CSUywE7ifuRbIE52ileMD2BMKiBQI2BQB0BUB-BYBgBcB6BcF

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6A70 0
234 B 1232ms
410ms Ping
image/gif 142.251.12.120

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~lswx180t&c=7881342935905&slotId=3940671467952.5&qqid=CKPUgbC5voQDFWEBTwgdisIL9A&fb=outstream-lima&ulv=1&cll=0&met.4=arp_a_s.1iz&vast_v=4.0&icc=1&icrh=0&icri=0&icrs=1&icru=0&icp=GoogleWhyThisAd&icdi=18x18&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240216_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.12.120 -, , ASN (),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:34 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 6A70 32 KB
18 KB 384ms
146ms XHR
text/xml 74.125.71.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-CpmFKU6ngXrvtiYKNCX0URTss0haneuVeQHONLnoD4THYw_5EW5pPjZ_7ae-4Bz3H_kDwPnlUkc3Es5eVI5UMzyHqUzg&cry=1&dbm_d=AKAmf-BDWdQiMAyKWNC3YbDBRn2lRKdazzNIeHHn7GBWYofX9TaAz4buMfNWgwDPlV-_rgu3wfT_yJB5o7bK50Jbh9G63YNplgeE7whqiTDDxFu_4Kz80kY9Svdd183gIcpQyIPBuHLPF1KiPg-QF93r8C9uCQFxH0zX3dh4JaDsxX9eLvKHbubimEuv0PBUO-NXvtUR539NBFPzE3HDZ4cbjqjLwL1MDTplnuSLtMGQgQbu6wzs_IsbaP4aFqtHL63cEK-le5QdAzwQwDL0iA3s8Dpu51XKCdsrwvaJJv-mdIsuqavCf-Nbjy9ea7gq-vsrKKLhV46on36Dx38o5ZBCvQUx0OdVdKbxlzF2REyYaPx4DEhbeHcFS0Ihb_34dhGU1NZAWRfcWKI62x7UWrmPrxUdHDHFZztxJAkyHW09FtEzKYiquL9DI89FuX6FlXl8bQIWxILayGa2aRRW4XxjOW19CZwMJR46QUvWFQwzKqa13rBLs2t-djTTAZXhXocdYjblyYhw1BDdP28s3_925jEv96VDeXDVzoSeTpYypH-FTTcAdBR-urKZFqAok2ZWpz9E-BDdgCcwOHqCDvAOgh0z6UsiS8iIAEXngRIVQZZcSrRVcKUi9qN8RqjfyHgchEYpvM5W08Jf52DOHERw2a9VTaxfFhbD3AtOFJ1UOl__jUcQRVKL-QTKiEx00kxsgB9Pz2cOzkLz4vsgFJtMUm0YHrc7CDaq_1cJDgpfgMfDRZ6GqOH6viDCWoXMZNQQ5EmunY1XgEeMqKCJfTezUTHm_zxy_HYozDVK3iZ7PGexagEL_fq4sp0MrsooZMymFOeEYLzBAK-L3LlsASnnJsInFgeVTMS3kJR5iOdNd1ubc5GVV9xmqNmhBDho7x1nRs99fAWjy7guGtVI0LOx-87Pc8lw0HcKDkGK9AKQxRGc05tbVvxQukKDHobD_qPXeCmtkumOuRvDGmGd2mIqSZkTMEZEC8xb6WQOYOCEBfKiJ_f5u_OZ0XxXxhipGFx08VTRsNtFfjix1Se3dY50AJPi70oTj_P3oAW8kaRskWavR5NQbI55N35Tmwzh1bO6-CC5Yxn8YV_-7RZmv07TKy7Nvx6BEnqRDiRYpY8mOxRpvFzr2STN_xMbf3vo_TbZi-kv8iQX0BQD1RHWQ5DETJS0O9dJFT3NkmF-umrMWqlJ7RoYNVCEwmTgMW-j-dvBCieyC_ydYbO1G2R2HFKoqtFIx5lQc9Fy2hoU3wOFYcyb2ycNP749lxy_YehSJN_1_VByZATzme5gAu2pZ6PGOnbRu_hYnruZqI2YDC-M1Ms-DOD4RI5PzZRIjbHZF5OfgDjG5roLRJknu87DD_CJglS3K-UO_jbNMKTdv_-a6SwVUAAu21jb9O4XB4L8AoATowqF7utpHwT-L-iq5Y1zA9sjt6QjjkKwSXGt-ofc87Hio8ybcGqK98JK4Lj96vohd4AfZUncFtQeckI96P7COM-3xhqCqGpiKr1WaHlcWIrV23acIHbqt7wuOW6I8FBsYEPbmVXY0yVMRT850quh4v1lhXd3fqbUwMWb_XD3Kc52KqKwdBuGAblnjhzqR2MToe7pHPRL4UsZ9HEHrUIc3U-H2M4L_T3Tw_M-Rw2wdLWL9SEILY_Ojq95-iLS3RvvymwPKZ3A_Ou_Qjryo8xKfKk7TerrGrCo5MW28MXfW1avMnBmEnyXPDGwVmfZinSlDv0VKVZy0I51T9cqp_5cAZ-oEMBLBMLr7f1-RqFRJY0Jrz3Ko-UBR4_SpOqk2jXtcFmykkjn8gRYWrIRqGS0qmAwUCxdH07FGT0aZB4n3wPUs9Lg3Gg20eTMHGb0EUCLdTYnaFPsslj6mdFWMFzSoSDNib1zqlYb_ESsZz9qvxz1RJT9blKNWppyeMGvDvtNTZzVfeo2Gd1MwWX7C6RwlfX99bK51MqFT1FI0r8gZs4u56EyCS6mM4XF9UQsaDH6YYJxVbiTWO-0hA1pYJsDHydQiLqFyyLozYJCCuqpssbAfq1ADXyIpiccnirZIvB647O8KrUn0hBnF0PQfl9KQc85M75BtRlGfFCPmZDxGnnPfDUttrrcYOoXX4cTYvpUiDT6pJRScwLh2DMKxr7EM3H4kO2GtkjyB02gmbMg8b0JLrtsHCSxXoqw2Dje19Pf-hIN-w58gJow-zDcLMEHnl0Nzee-9cMyKGcvp1RXPAXtG0NmPCcUIGWOkve6o1JyEHqFb5prtoyChAzGBq4qpl2kGSSFWe3UZCrXJQuyzqD2HavtrooEFTTEwBO9a3Ld3BOBz9NdYy3KG-igWujTWeOyK3SyfPU8fFwutLaCDCQbJuJ_RcSt5_5tIs6VPUyMlb_E6daDF86q0COSE7spzo5npjSDZvZfAAyjJRgp6ndJCeTtgk4QvV-mMaFUsy1OkRZi1PYlbYhkgMlUU9z8W2ZIBHybCoLlepwMySlyuNx5OFfOldrEPeogLrulRysRQq4V0L-nbT2RQz8wdz9e-84DPxU1FXW_AzIIVqtTxSNAl9p0DoFAyAkyPhDGwvG34cR16dXWQansRi3AkPnomVNwRhPnCEGnlAnVPKp9QErOL3bC9A-jCnBsL4NPfzdId-bLXoe7c-TVii97xiE6sQawGxmaWzjZSTlXMTEbH_qmnk0C7MEz3teyJqi52vVrjfAxC7hCpjdv9p1CRUHhSXM9JEYG5BVdD7UZIxELOd2dTUVzsJUMk8al2TgpEkPNyIKvgVQ6DMfNWIjZOS80cO5tmJ_p0G3wFZRl7s80xCdo6uPdO1rtj-u9NF-NkvipjLcxe5kp4mcBGEJ5OrzhG5TulZlijqKj--ovXk25lpPKI1Q9SbQssEyu88wgXhMUy9ECklxjDypQAqYGUSahFSSKEVRbeopQqeZHUVgfdX1dz8wEQ7PmbT5YcR5kjL9MyOPe3Jw8g32Yqaf4QiZECIg1wc-pozqY7Dq_W0FSpbDEWC_i37mT2Yu56GJOWgi-z1nFPXMP4gPCAGVamO4dWbxJwRkiW4RN_EZGjgNfSinaMLza-lgrzHrDesnMYURD1PjNLjTsZ4H-748JKxlgOR3uzHrDC22orZOY94KWiRIA-FG6FJCjrvD8_GROqEdigtAJoD6IrRUxEXpI2WvVFf0fJM7VsMmWcy7ajKFX_UElXztSiOegKyg0-LQIil15WARcE6w_iNlzrrz7BSKo9GkvXD-Vy4SWajFAqXWp6kKL3pXvXoABYj3QXUe-TxePhA7eF7FgpoMj_1mZH9yW-sWHqAs44lewb5Eh6tob0L9br8UomWKwzij70T0bsupsFCOo8vEWr2qo0nWAp8oT20zjMjNaSnQd_cxSqicTFhn3PLNIboKJwGKf9T0aJCIkwCy2kgEvjq0PBbkEr7nj5H59sWQarQMW1xheWtam25I5wFAv68_J5Ed5xWMfpInY04ikOfgHZLq8htGyip8D44GEUKLA-rxBoE6XQuFXHQp_Le9MeQUVmx9Wno6n5bUutBTe_Z5EnJstA3zJoDDOJ7MuWGcRyWKSMcJ7w-bKK6o-o1PQeVvs8LtpUmfTGet58oQnU7djyFBOoe26luNajV43CArg4myL5qtsgj7GICyToRnIKgBuTVl2x8UYIq9d61tOsK5XOMYRopeq1UCl0x6ANC3OZ-1QWLDL2nJUW0wP0ECZR6V1db_Mz6RFQ0PD599ypVVYY_G3ZyKEsHDkERFjV3FIAayfRbC5si8j2rOuBtDI3bd1aG_Xdo6-0vEj3a2GQPUfokMUKBeYOiqqpCJ_UsLv8SKGoROTHrur599XTa-hwoyCqpnXj5OoGZyFtUrBqO6UiqJiMwvKEwEK_GZjOwCfIQD_NAbnqXfa_lSJzCLKeCCxj8CPTc_KkDEyemqi24uYxeoHqXoUaaB7vYW79BVdZKdBOHtY1YcwZ3z-79gP6lEwvpVhkkd3IKDFYAdaghX96T_fLil7VUxYVgQkzZTWfgk8C_crB0tHyixbkBJdaxxKokTRBwemT6RcZkxaau6PDwdI-t9AUYDTz9ZqCDYdpiF-CJcI1KApEQ7JlOnWcgSTBxdKZx79WygN4nM54_WY&cid=CAQSTgAvHhf_z7tVFSucbSLVSWIAKIuAvV2kjjpGHj_XuoN5UbxmGMCmNtNr9903YTcSUjXSgLPKzjR8vPKl_szK-FQKMfH3e_N68gtzXHMQcxgB&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1&nel=0

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240216_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.71.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wn-in-f157.1e100.net

Software

cafe /

Resource Hash

c8c04fa08f74366154e79d03524278c2ec82e40c7fd821d5b13a4bbda4381bbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:33 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17651
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 6A70 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f200917c97d2c5c24c1db8e032dff80eed65392a0191fe2324e8ef121e7a393c

Request headers

accept-language: he-IL,he;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 top_ads__homad. Show response
fundingchoicesmessages.google.com/f/AGSKWxX6ag9qqHqx3CS9gmq5OB5GhuZm80d9yt4AppaCNHSShvlfumkUBBKS_-iWgHpXiXplJdeX3YCiPnStTkFjtb3u788L4MB1sASbwUjDEfG7BTT6USOuCrITh2x4YKLJRB7wObtS0e1LOtcJh_zenRDUcycfd... 54 B
109 B 131ms
130ms Script
application/javascript 142.250.185.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX6ag9qqHqx3CS9gmq5OB5GhuZm80d9yt4AppaCNHSShvlfumkUBBKS_-iWgHpXiXplJdeX3YCiPnStTkFjtb3u788L4MB1sASbwUjDEfG7BTT6USOuCrITh2x4YKLJRB7wObtS0e1LOtcJh_zenRDUcycfdZ0hzLAgsgdB8DeXKUo5Q8Mfi1ubVJCc/_/adoverride./sponsoredlisting./adcontrol./top_ads__homad.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.iw.2bbfWrW58pw.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMzrzOqFV-JlTJbO8ye76JeCtf3HDg/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

ESF /

Resource Hash

c1d6b998fbeddc17b9f8e6351eb4b97746a9bf8591ab1b23befb359737e25797

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--1FMgwnAxkdYs5AAwvQB8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:33 GMT
content-security-policy: script-src 'report-sample' 'nonce--1FMgwnAxkdYs5AAwvQB8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzj6mHU4pJicNGQYjjvdIfpOhBfVHnKdBOIaxmeMbUC8YPwZ0wvgNhA4zmTBRAz_nnBxAnE7768ZOL4-pJJAojVgPid5Cumb0C8w8eDhW_ddFYVINZcP501EIhjnk9nTQHixawzWFcDsVP6DNYAIP6cOYP1NxD71M9gjQJiIR6Ol19vr2MT-HCwo48ZAHm7QIg"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 show_companion_ad.js Show response
pagead2.googlesyndication.com/pagead/ 30 KB
11 KB 116ms
116ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_companion_ad.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

bca910b1befa38ccd56ad9eb8529ab16148a69cfd05c5741b897103b1a4daa1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 06:56:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2765
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11577
x-xss-protection: 0
server: cafe
etag: 14559776627737036930
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 22 Feb 2024 07:56:28 GMT

POST
H3 204 AGSKWxWFvxt0ZzzhPBVVDkRwt0EZE3VeKtbDuBaDTSU7C64EAHurnGr_voEke9mj0niD_37TInNRxFA2NTxiTdJK2lsWXxTeY4ldVZ_xU2wZLoOtbURHRJ5xR8A20-9MUKdtfZ7Dbv7enQ== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 362ms
130ms XHR
text/html 142.250.185.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWFvxt0ZzzhPBVVDkRwt0EZE3VeKtbDuBaDTSU7C64EAHurnGr_voEke9mj0niD_37TInNRxFA2NTxiTdJK2lsWXxTeY4ldVZ_xU2wZLoOtbURHRJ5xR8A20-9MUKdtfZ7Dbv7enQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-AxKvvYrREkjkVTagqMO2GQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 22 Feb 2024 07:42:34 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-AxKvvYrREkjkVTagqMO2GQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmJw1pBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYAIBbi5nj19fY6NoGOecvkADJvFRc"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://fileforum.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6A70 0
0 150ms
148ms Fetch
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CBJ6l5_rWZePEJOGCvPIPioWvoA_7__DEday0rZz5EeSsjKLEPRABINnfigNg-br0g5wQoAH_8afcKcgBBakCXkdUgKhFkj6oAwGqBKACT9D_WszEHsPgHgci-uUtdn9mxD_9EswOaBx1_1lXRO1Hl-1kSPIbi6VZ2iqrEoyoLjLHcFPijJ8n174f-rWSQCymHeMVt3mCniogUVjVmgIINVyUsNxxlvpbLuP9qELKfvEnUFkP_XUOFHLMbBhT4TV8eN985K_U1PsIoAL1RRfAwhLgIVZlDminyEcLLaCaoSl4fT9ga8iwcvOgn8qXTHtq2vFNnV11KUDfVWZ-ObCo1AQUIGpOQ-FJMqhnYyvwImQeX3ZSpVEJ0Q7ubK5ZyI1OAahZ4xWsi54E1MfYZPzv_UXxjK9dhTAYhizpc7TLNYv5vc1dKC-H_1z-Zcl0-aCwCqkapJgK8NWyNErMXa2IN0zxHtQgNi7DOXA4lP9wwASGwZv_vATgBAOIBf283bZLkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAZ2gAf_qfi7BKgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4b2AcA8gcKEPjvBhi57ezsAdIIJAiAYRABGB8yAooCOgmAQIDAgICAgAhIvf3BOliQoP6vub6EA4AKAcgLAdoMEAoKENCF0Zb1zoDqXBICAQOwE7ifuRbIE52ileMD2BMKiBQI2BQB0BUBgBcBshccChoIABIUcHViLTY2NzYyNDE0MTg3ODUyNjYYAOgXBQ&sigh=ptiLo9eDN2w&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgAvHhf_z7tVFSucbSLVSWIAKIuAvV2kjjpGHj_XuoN5UbxmGMCmNtNr9903YTcSUjXSgLPKzjR8vPKl_szK-FQKMfH3e_N68gtzXHMQcxgB&vt=10&cbvp=2&vis=1&nis=5

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240220/r20110914/zrt_lookup_fy2021.html?fsb=1
Attribution-Reporting-Eligible: event-source
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 22 Feb 2024 07:42:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWFvxt0ZzzhPBVVDkRwt0EZE3VeKtbDuBaDTSU7C64EAHurnGr_voEke9mj0niD_37TInNRxFA2NTxiTdJK2lsWXxTeY4ldVZ_xU2wZLoOtbURHRJ5xR8A20-9MUKdtfZ7Dbv7enQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-y19x7-Tw0dAmnGIJXCF6EQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 22 Feb 2024 07:42:34 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-y19x7-Tw0dAmnGIJXCF6EQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmJw15BiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYAIBbi5nj19fY6NoEXO17KAgA1lhXX"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://fileforum.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6A70 0
54 B 786ms
411ms Ping
image/gif 142.251.12.120

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=3~lswx1818&c=7881342935905&slotId=3940671467952.5&qqid=CKPUgbC5voQDFWEBTwgdisIL9A&fb=outstream-lima&vast_v=2.0&vmfc=10&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240216_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.12.120 -, , ASN (),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:34 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 6A70 41 KB
15 KB 115ms
115ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240216_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:40:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 86523
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Feb 2025 07:40:30 GMT

HEAD
H/1.1

200
OK

file.mp4
r5---sn-ua87sn76.c.2mdn.net/videoplayback/id/368f431842991a55/itag/22/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740123753/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,... Frame 6A70
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/368f431842991a55/itag/22/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740123753/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signat...
https://r5---sn-ua87sn76.c.2mdn.net/videoplayback/id/368f431842991a55/itag/22/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740123753/sparams/acao,ctier,expire,id,ip,ipbits,itag...

0
0

262ms
59ms

Fetch
video/mp4

74.125.98.170

General

Check archive.org

Show headers Download Go to

Full URL

https://r5---sn-ua87sn76.c.2mdn.net/videoplayback/id/368f431842991a55/itag/22/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740123753/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/75B15EF381A7E83651A011C455C33807029173BD.15E4E89D6A43FDD8A2C5A484613CFB6CAC5D9057/key/cms1/cms_redirect/yes/mh/g0/mip/31.187.78.153/mm/42/mn/sn-ua87sn76/ms/onc/mt/1708587153/mv/m/mvi/5/pl/24/file/file.mp4

Protocol

HTTP/1.1

Server

74.125.98.170 -, , ASN (),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 22 Feb 2024 07:42:34 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 10445532
Last-Modified: Mon, 05 Jun 2023 07:48:24 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Thu, 22 Feb 2024 07:42:34 GMT

Redirect headers

date: Thu, 22 Feb 2024 07:42:34 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 642
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
location: https://r5---sn-ua87sn76.c.2mdn.net/videoplayback/id/368f431842991a55/itag/22/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740123753/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/75B15EF381A7E83651A011C455C33807029173BD.15E4E89D6A43FDD8A2C5A484613CFB6CAC5D9057/key/cms1/cms_redirect/yes/mh/g0/mip/31.187.78.153/mm/42/mn/sn-ua87sn76/ms/onc/mt/1708587153/mv/m/mvi/5/pl/24/file/file.mp4
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://googleads.g.doubleclick.net
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 help_outline_white_24dp_with_3px_trbl_padding.png
imasdk.googleapis.com/formats/wta/ Frame 6A70 453 B
589 B 113ms
112ms Image
image/png 142.250.185.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imasdk.googleapis.com/formats/wta/help_outline_white_24dp_with_3px_trbl_padding.png?wp=ca-pub-6676241418785266

Requested by

Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f10.1e100.net

Software

sffe /

Resource Hash

e519cc4b7b8fdc64a7aaafc1b808cde266a234205aac0d6c55589c12446d565e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:38:32 GMT
x-content-type-options: nosniff
age: 241
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 453
x-xss-protection: 0
last-modified: Wed, 13 Oct 2021 14:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: image/png
cache-control: public, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 22 Feb 2024 08:28:32 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6A70 0
45 B 772ms
410ms Ping
image/gif 142.251.12.120

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=4~lswx18dn&c=7881342935905&slotId=3940671467952.5&qqid=CKPUgbC5voQDFWEBTwgdisIL9A&fb=outstream-lima&gpm_i=8&gpm_c=8&gpm_a=8&smb=Infinity&br=2019&mt=video%2Fmp4&vs=1280x720&msm=1&aits=0%2C18%2C22%2C692%2C59%2C342%2C343%2C344%2C345%2C346&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=22&vsrc=web_video_ads&hcn=0&met.4=arp_a_e.1vl~atrd.1vq~videopreviewvisible.1vu&ua_e=1&ape=1
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240216_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.12.120 -, , ASN (),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:34 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWFvxt0ZzzhPBVVDkRwt0EZE3VeKtbDuBaDTSU7C64EAHurnGr_voEke9mj0niD_37TInNRxFA2NTxiTdJK2lsWXxTeY4ldVZ_xU2wZLoOtbURHRJ5xR8A20-9MUKdtfZ7Dbv7enQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9CV0ZRVs2D6VbJhi40vPHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 22 Feb 2024 07:42:34 GMT
content-security-policy: script-src 'report-sample' 'nonce-9CV0ZRVs2D6VbJhi40vPHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmII0pBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYAIBbi5nj19fY6NoEPe07LAgA3zRXQ"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://fileforum.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWFvxt0ZzzhPBVVDkRwt0EZE3VeKtbDuBaDTSU7C64EAHurnGr_voEke9mj0niD_37TInNRxFA2NTxiTdJK2lsWXxTeY4ldVZ_xU2wZLoOtbURHRJ5xR8A20-9MUKdtfZ7Dbv7enQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GI0QPt1833EYaps1JbyM2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 22 Feb 2024 07:42:34 GMT
content-security-policy: script-src 'report-sample' 'nonce-GI0QPt1833EYaps1JbyM2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmLw05BiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYAIBbi5nj19fY6NoED92fIAQA2PRWN"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://fileforum.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxWOnsaV4JW8QsDmD0VowC_2TDWOsgR-l2D6NmSniP7Hhs9dnBiyuq6TNiN9vKX9vD9V0FGGdhoMsXXxen-QZtc9Ot3PexqUP4bnW5JbiXoop8wssKymuX3VUh_ZZeyE0olQ8INROQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 155ms
155ms Script
application/javascript 142.250.185.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWOnsaV4JW8QsDmD0VowC_2TDWOsgR-l2D6NmSniP7Hhs9dnBiyuq6TNiN9vKX9vD9V0FGGdhoMsXXxen-QZtc9Ot3PexqUP4bnW5JbiXoop8wssKymuX3VUh_ZZeyE0olQ8INROQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA4NTg3NzUzLDkyNDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9maWxlZm9ydW0uY29tL3Byb2ZpbGUvbnVyc2VyYXZlbjgvIixudWxsLFtbOCwiMmJiZldyVzU4cHciXSxbOSwiaXciXSxbMTgsIltbWzBdXV0iXSxbMjAsIltudWxsLG51bGwsWzk1MzIyOTAwXSwxMSwxM10iXSxbMTksIjIiXSxbMTcsIlswXSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

ESF /

Resource Hash

579b8daaa438c7b358005e655c44244e9d04d2dfaced4485b8ee93019915a3cd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ywymnRTYwSb4r8eNRipuiQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:34 GMT
content-security-policy: script-src 'report-sample' 'nonce-ywymnRTYwSb4r8eNRipuiQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzj6mHU4pJi8NeQYjjvdIfpOhBfVHnKdBOIaxmeMbUC8YPwZ0wvgNhA4zmTBRAz_nnBxAnE7768ZOL4-pJJAojVgPid5Cumb0C8w8eDhW_ddFYVINZcP501EIhjnk9nTQHixawzWFcDsVP6DNYAIP6cOYP1NxD71M9gjQJiIW6OV19vr2MT6Fj4hBMAPcs_3w"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 p5fnC8UiJgY_rpObzZ9ptSWDjQ2aRmww7Wqd7-i_gkQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 3F00 51 KB
19 KB 116ms
115ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/p5fnC8UiJgY_rpObzZ9ptSWDjQ2aRmww7Wqd7-i_gkQ.js

Requested by

Host: fileforum.com
URL: https://fileforum.com/profile/nurseraven8/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

a797e70bc52226063fae939bcd9f69b525838d0d9a466c30ed6a9defe8bf8244

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 14:26:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 148568
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19860
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 17:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Feb 2025 14:26:25 GMT

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame B887 23 KB
8 KB 115ms
114ms Document
text/html 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

accept-ranges: bytes
age: 86974
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 7799
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 07:33:00 GMT
expires: Thu, 20 Feb 2025 07:33:00 GMT
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 AGSKWxU5E_a_3kAn8ZOE4qKUhihbpsruNTOYcHe5sNzmrR8QFfTl3h-P9iTOSTLWiXgi8T7bw2krgiqockTpdt5IkpTASTQR4tsHSJFuTfsbZEtvLqd7m1dmmqHCftaMr_O-4YKNCGIkUg== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 124ms
124ms XHR
text/html 142.250.185.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU5E_a_3kAn8ZOE4qKUhihbpsruNTOYcHe5sNzmrR8QFfTl3h-P9iTOSTLWiXgi8T7bw2krgiqockTpdt5IkpTASTQR4tsHSJFuTfsbZEtvLqd7m1dmmqHCftaMr_O-4YKNCGIkUg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-5FMyF8TKgLtWFJZQpavCJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 22 Feb 2024 07:42:34 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-5FMyF8TKgLtWFJZQpavCJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmJw1pBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYAIBbi5nj19fY6NoELvQ_9ATQDFbo"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://fileforum.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWFvxt0ZzzhPBVVDkRwt0EZE3VeKtbDuBaDTSU7C64EAHurnGr_voEke9mj0niD_37TInNRxFA2NTxiTdJK2lsWXxTeY4ldVZ_xU2wZLoOtbURHRJ5xR8A20-9MUKdtfZ7Dbv7enQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-w_Dbn_xmuZtcDK99OU6ZCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 22 Feb 2024 07:42:34 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-w_Dbn_xmuZtcDK99OU6ZCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmLw1pBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYAIBbi5nj19fY6NoEPC3cEAAA2FhXO"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://fileforum.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 161ms
160ms XHR
application/json 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20240220&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

3f01a7c5df0321e128865e698ab6476688ab6e88e49b09ae1f739063573579b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12562
x-xss-protection: 0

GET
H3 200 BoEj1MRYnOy5BSN5ElbJySd6MGFyYBWT_ZtkFEIAVvM.js Show response
pagead2.googlesyndication.com/bg/ Frame B887 39 KB
15 KB 115ms
115ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BoEj1MRYnOy5BSN5ElbJySd6MGFyYBWT_ZtkFEIAVvM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

068123d4c4589cecb90523791256c9c9277a306172601593fd9b6414420056f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:28:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 843
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15302
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 17:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 21 Feb 2025 07:28:31 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 176ms
176ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402150101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://fileforum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:42:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 22 Feb 2024 07:42:34 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B887 0
20 B 149ms
148ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=BE3_Z6frWZcS4LqDjnsEPgY-n4AEAAAAAOAHgBAI&bg=!NjWlNXrNAAZ3BdUuVwU7ADQBe5WfODuoLRpx9JkASK228k7q0dzOyAkC9S2HsEgEJV0ZD9M9J4IQlEUBomUVjhSTJ9UkAgAAAEVSAAAAAmgBBwoAEr55u1YIZvjYTMEib_KRgHuLrpkC6t1mU6jIbercSilcRUfTZbeWs_E8oE4OfcuBrs3tKnsRJE7knaIGd4UjuiKaUua8f5vBWarhGjcHoInX5k2iZ5_baeXidCL8oYpMnSHD9vmWjhuvZ92zpxC63F5KawdVnwxjZD39bhv_h-viSxHfDKL61MCGcA0ZJqv5esR8A6geBfhr8TcDlO8qwnLmLV4pP5HKaq3JAH5pWU881T4UHqIIvTwGPHm-vrh5-mCShGYAVJgWKw0DzZrNKjUGXpaKYubb0X7LdJGN6zj7mX4lZPz1TlP5xbymj79cRv_qv5luMNCBPAt7fyBqbKK3Fmz6j4LtiXP3KB-PIq8KxvHuiL8nyivAthcs3-qsRshwt1UZRuoMD3Ma-bDuqH_MLBoA5vvHc-Bmgwlw_4LQh-EQoW33xsZCABE8Y3myh7_IInLqvCBO9zqx4Y0V7zyJ0nEL4Y_ywpaDlfDgtVU1moswTrieO0nx9qP03uFmhj-RfvMeXgHmSbxgjIJD4jOX1Q57AEnLTrtkLuzCO14U82TuVGAHNfD3KRybZD67TpGMLNv-1oTuA_CXGl3Hv7eNdfsm6rwERb_Zn5aL5rPL40YmFQw9YFSP-0-68pIRl_WaNcQ2iwGGW32pCv2LOcvECp8QeZ_8OuiI5cdXennSjPzCPBTa2f_DyFWY0A7SVWs2f348IyD-9iiJCtP0Jbg2QyJCUfXRYa66-H79ogTIuP8IFZoCoZ56hBnel67jBc5N26KaJZQlpHmQzGzXCpZVWRP39npogPKaBB1dYXhscI3V63g9ulOyTtTbTISrjKtTf2u_L6Eqr8GN5x-SeDFi6TqkjBaCwayuv_U6A5RNiq3H8vN2GhhFubt3KEKpLmRIzPA-DFHuWNSXdN82W8uaI6t1QyUXnXVx8pFI6WD5Xb1zrPE9TqsEUQY0iq-WVpHVI2mDDs5XsyLBgKjf9m11d8HjBYJJc1yApUP5GqlWIEyu-QIvJECWHjb7Fzwx

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame DA6A 13 KB
5 KB 114ms
114ms Document
text/html 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fileforum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

accept-ranges: bytes
age: 633
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 Feb 2024 07:32:01 GMT
expires: Fri, 21 Feb 2025 07:32:01 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D990 829 B
988 B 128ms
127ms Document
text/html 172.217.16.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f196.1e100.net

Software

GSE /

Resource Hash

1d548496dc31bd98c6b532f0ce18b1820a2bd744545e77e58105264f54b28580

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rZIGsackkLspjWPCuHPqYg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://fileforum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-rZIGsackkLspjWPCuHPqYg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 22 Feb 2024 07:42:34 GMT
expires: Thu, 22 Feb 2024 07:42:34 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 206 file.mp4
r5---sn-ua87sn76.c.2mdn.net/videoplayback/id/368f431842991a55/itag/22/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740123753/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,... Frame 6A70 575 KB
0 121ms
60ms Media
video/mp4 74.125.98.170

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.98.170 -, , ASN (),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

expires: Thu, 22 Feb 2024 07:42:34 GMT
date: Thu, 22 Feb 2024 07:42:34 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-10445531/10445532
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 10445532
last-modified: Mon, 05 Jun 2023 07:48:24 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://googleads.g.doubleclick.net
client-protocol: quic

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 80B2 42 B
64 B 146ms
146ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstoa2Zjn9aspFP9BfX0V8uULtHqnoRmTNPoOySR3YlorIS-yGIAbUGA-rpc2TAPveaifEmCZqQPNFUMejqt9KW6fuAFAXp1QF06g9dca9MbmYxSnMsWGidsm5j3Mkm02dd72NfOSMdHnh4BPtF5qWjoPKTbzIbZ57s&sai=AMfl-YSjZt9MVN_x8n72xSl1WJCNsuC3-ChBUg0k_5Yxj0NLYcOBQsuk5tT244NNObyLd7bIL4rmsYgArIaXDKadnjJvOUVvPMNPEtW_ZXGNa4ig4Xi8Tk-vnavJVE4ftvBccUqtvOYZ3rGYAqVDp1vn&sig=Cg0ArKJSzO2euRv7u8b3EAE&cid=CAQSTgAvHhf_zgi489FUvuCGCLbMXS1ABuaiIVnZ4QbT12Z0462D22hPtGc_VGMrfnpQGOuUVnZ4f3jD82zqlCt6tbPEJs0nLqOEOxX96UHIdhgB&id=lidar2&mcvt=1007&p=0,0,280,336&mtos=1007,1007,1007,1007,1007&tos=1007,0,0,0,0&v=20240220&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3368998127&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=452055200&rst=1708587752133&rpt=1517&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Feb 2024 07:42:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D990 0
0 146ms
146ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20240220&jk=2418963826889958&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s07-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 BoEj1MRYnOy5BSN5ElbJySd6MGFyYBWT_ZtkFEIAVvM.js Show response
pagead2.googlesyndication.com/bg/ Frame DA6A 39 KB
15 KB 115ms
115ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BoEj1MRYnOy5BSN5ElbJySd6MGFyYBWT_ZtkFEIAVvM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

068123d4c4589cecb90523791256c9c9277a306172601593fd9b6414420056f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:28:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 843
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15302
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 17:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 21 Feb 2025 07:28:31 GMT

GET generate_204
tpc.googlesyndication.com/ Frame DA6A 0
0

GET dc_oe=ChMIhNGFsbm-hAMVoLEnAh2BxwkcEAAYACDd_fxbOhoIm_2l6QQQhsGb_7wEGJ2ileMDIKy0rZz5EUITCKPUgbC5voQDFWEBTwgdisIL9A;dc_rmcid=CAQSTgAvHhf_z7tVFSucbSLVSWIAKIuAvV2kjjpGHj_XuoN5UbxmGMCmNtNr9903YTcSUjXSgLP...
ade.googlesyndication.com/ddm/activity/ Frame 6A70 0
0

GET /
googleads.g.doubleclick.net/pagead/interaction/ Frame 6A70 0
0

GET view
googleads4.g.doubleclick.net/pcs/ Frame 6A70 0
0

GET pixel
googleads.g.doubleclick.net/xbbe/ Frame 6A70 0
0

GET gen_204
pagead2.googlesyndication.com/pagead/ Frame 6A70 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 6A70 0
0

GET /
googleads.g.doubleclick.net/pagead/interaction/ Frame 6A70 0
0

POST csi
csi.gstatic.com/ Frame 6A70 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/generate_204?U1NLMA

Domain: ade.googlesyndication.com
URL: https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIhNGFsbm-hAMVoLEnAh2BxwkcEAAYACDd_fxbOhoIm_2l6QQQhsGb_7wEGJ2ileMDIKy0rZz5EUITCKPUgbC5voQDFWEBTwgdisIL9A;dc_rmcid=CAQSTgAvHhf_z7tVFSucbSLVSWIAKIuAvV2kjjpGHj_XuoN5UbxmGMCmNtNr9903YTcSUjXSgLPKzjR8vPKl_szK-FQKMfH3e_N68gtzXHMQcxgB;eps=CIBhEAEYHzICigI6CYBAgMCAgICACEi9_cE6WJCg_q-5voQD;met=1;acvw=sv%3D961%26v%3D20240216%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D37717%26vmtime%3D4%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D33554450%26i0%3D33554450%26ic%3D0%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%3D200104%26avms%3Dnio%26qi%3D45572109%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,200104c,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0%26co%3D452055401;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1708587754901;dc_rfl=%5BURL_SIGNALS%5D;ecn1=1;etm1=0;eid1=11;

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/interaction/?ai=Chl4d5_rWZePEJOGCvPIPioWvoA_7__DEday0rZz5EeSsjKLEPRABINnfigNg-br0g5wQoAH_8afcKcgBBakCXkdUgKhFkj6oAwHIA5sEqgSjAk_Q_1rMxB7D4B4HIvrlLXZ_ZsQ__RLMDmgcdf9ZV0TtR5ftZEjyG4ulWdoqqxKMqC4yx3BT4oyfJ9e-H_q1kkAsph3jFbd5gp4qIFFY1ZoCCDVclLDccZb6Wy7j_ahCyn7xJ1BZD_11DhRyzGwYU-E1fHjffOSv1NT7CKAC9UUXwMIS4CFWZQ5op8hHCy2gmqEpeH0_YGvIsHLzoJ_Kl0x7atrxTZ1ddSlA31VmfjmwqNQEFCBqTkPhSTKoZ2Mr8CJkHl92UqVRCdEO7myuWciNTgGoWeMVrIueBNTH2GSk7ndk-p4EbBel3k9tP7q6SZqXfxLn3O0FBhJO2G8ffdC4Xq90MCV_zt_7quzve0ErBfNj3QZD0-dvFQW5JWusd9urYsAEhsGb_7wE4AQDiAX9vN22S5AGAaAGdoAH_6n4uwSoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAfgvbECqAf_nrECqAffn7EC2AcA0ggkCIBhEAEYHzICigI6CYBAgMCAgICACEi9_cE6WJCg_q-5voQDgAoByAsB4AsBgAwBqg0CSUywE7ifuRbIE52ileMD2BMKiBQI2BQB0BUB-BYBgBcB6BcF&sigh=XHIevHBJ5-s&label=part2viewed&ad_mt=5&acvw=sv%3D961%26v%3D20240216%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D37717%26vmtime%3D4%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D33554450%26i0%3D33554450%26ic%3D0%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%3D200104%26avms%3Dnio%26qi%3D45572109%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,200104c,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0%26co%3D452055401&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1708587754901

Domain: googleads4.g.doubleclick.net
URL: https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss17rR7bPdeLVxDufzwd5CCKtUuwswAhxzOIlCaIxtxZLnKJAeqqh4OqGTHnzMKWEOEKmZvdbOlZTNe-Q7-2mUbKR1CiFdgJQFAbDxMnze9TcRzzA6oi952FiPaFU9Pdn1gEYgVMXUaN-FqFVTecvaN62rVQi31LB75cp_Ho8uCisIeJGLcIJro9-S5As_zTHGfOY6mpGu-P-ZNtkqJ6etRw6z9GTH2oHdqqDGzcG2RUobB2o4DshEflaXm6dr-EDoBtypjdstpWiOJ4nmBu-Qv2Ne4YVhm0Um3bYlErt9ABV2zF3h8y1HENG_745OfaIAM8qKm48J8zdbPbhX_trc0VCjFkSXdwUHX0izxU2ZUxxklM55VWGGT9t-UZWlTvrd4XAOZpmeu7W6CMc9we2pkrmDIX7705Hz_ibQTQo3S1hMe3CG-oDn9UmEI_qdwLJ1L5yF-R6sBV85fGGxFQui-FlAg6ZUfJCAqFJI_43K518UNO-eoWkWQcrQz4F8s3gOdKxTsVwFmj4O5UPRc2lGfUGgeMylVZI9w-0XTNnYNoOqOw9m9mlk-RnXyQ7rhp_eUj1GoktvJTd7gtl6Zh0YDvsr0If2dnayqmiFMa0KQvK1FcEj32z6_cl60ZfKnKyCtEiUaZdT3GmbObdpDogTOI1m4k-cbuK0dw1wrLBKgbVSBrYCiwl9v1-dvgxWVcrIqf0tuQc_mvtgwuidZNeNZL82HJHhVuCgCZDYQLObdODzgQHqRyM5fko_SmOPAgsss5femrTFKTM-otw_tM3VmCzqMUIrKtc7jSH_o5Vz7v7jIvHqKfZ-tzW_cHEQ0e0zg9H9DtF4_92DLGGsi1ipsSi1rAbRUN7wU6WV7vQzfCCauGS1PrbmwnQi2LhI8IZGwjGu1qS7sDhikzUJdqFJRfqdoZj5o7p1IYuEcGO5A2UozKEwJYOsUeh5eYYn22sAJLCWZGgCIsmy1bD0kXYt31S0x53d-GfqRQkys1Kccp4bJThhpFSgVvmKDI6lj7cB2DeSrVxNGtAuoqhO_xaKs5e0W1kthIW7j7ZgwVcNaaTo8-2vTv5UkBJfvMzsLaubGptboKJ1PAl20CXgG64hWdJ7uO7NLBVlYPb_AzdSa2uJDTK13H8PUC8EHMd_OnbOHB7cNd53sFi2nbJd01VaAuHpyfydzYCNTgL6032dectYAg1oOAAL_FiZOFyVTdwQDy1yIjYZ7ImoPNxV1uNqVsXJeJRMdzntRyve-hHRcn9u4PgmveOAKqIiyHtDLAau8xNI7UDgDUCR-thV1uss1hVa3n3EWGAmiIqFczmOKxrhbNKzhepF_aOYg6kvktJA_WdGgcGoeT4tXD1fP&sai=AMfl-YQCYFd25ewsM_Hn2DG1lXU3iRE8DrSsEXoZuWd_H0yINZuZyFezM24jMmvbEGSrOdeTsYKi42nQFJYtoEGewIvgM1ebYrgbPV87EXdK67NIiXKFLSI8LeNUCgauLmnBXPVLjlj8GZhDznbDX8795gh01GdkTu1APX4YQJl8uOKdMnJMSr6RLCzpHZVX56UxtRoBF14DEykzKEbcmBlrlIn2seqGaRZvGfL_Hdo9a-Dlx1shrPQSRQyJGAfribrpmrZ2azlbo14oPG148b93MAsJH5RvqlQD22h2Lw&sig=Cg0ArKJSzP6qRNdFLl3AEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&adurl=

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJy6pwIQm_2l6QQYue3s7AEgATAB&v=APEucNU5_uSJ5eM2MKrtZu2rjN0inK2Qq4XupcKYmsBUr6F4NZQWQTKj49kd1OS44zlHAOfDEwUK819DvqU72kkedEfQfFKsf2_uFig_M4guZm_J2lDPunY

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/gen_204?id=video_impression_ping

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssNFri4a0oDpkQCot0KHmtlyQ7RQMsw0CdktwDprCDpoV6GzD3Kkb0eCef1Hp-HAdzj4TqTCwO8CxMJfr-Q3xd5anNJQsNL7VF6mcXuAy0uALaCpFS69Yyv8iXIpe7zWAJEBBSQ3QaBmd9seeOZWN6sybU-TeQGUtw&sai=AMfl-YTMKGt5qz5lTdqvzJxyn_cNMNr6_qMBm5Dbso9uC7Df-nWkUCqcu7gqlfKhdQgeI_GvxWszMZ38bZqzwOuJG2BHMzodaupjvDXsAp1kdxlBnI5p8JTVCwrV3YXZu37TxFq-pdvpkurhhYeqWEGb&sig=Cg0ArKJSzBktSkq8qRJZEAE&cid=CAQSTgAvHhf_z7tVFSucbSLVSWIAKIuAvV2kjjpGHj_XuoN5UbxmGMCmNtNr9903YTcSUjXSgLPKzjR8vPKl_szK-FQKMfH3e_N68gtzXHMQcxgB&id=lidarv&acvw=sv%3D961%26v%3D20240216%26cb%3Dout%26e%3D15%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D37717%26vmtime%3D4%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D33554450%26ic%3D33554450%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%3D200104%26avms%3Dnio%26qi%3D45572109%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,200104c,15%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0%26co%3D452055400&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1708587754901&avm=1

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/interaction/?ai=Chl4d5_rWZePEJOGCvPIPioWvoA_7__DEday0rZz5EeSsjKLEPRABINnfigNg-br0g5wQoAH_8afcKcgBBakCXkdUgKhFkj6oAwHIA5sEqgSjAk_Q_1rMxB7D4B4HIvrlLXZ_ZsQ__RLMDmgcdf9ZV0TtR5ftZEjyG4ulWdoqqxKMqC4yx3BT4oyfJ9e-H_q1kkAsph3jFbd5gp4qIFFY1ZoCCDVclLDccZb6Wy7j_ahCyn7xJ1BZD_11DhRyzGwYU-E1fHjffOSv1NT7CKAC9UUXwMIS4CFWZQ5op8hHCy2gmqEpeH0_YGvIsHLzoJ_Kl0x7atrxTZ1ddSlA31VmfjmwqNQEFCBqTkPhSTKoZ2Mr8CJkHl92UqVRCdEO7myuWciNTgGoWeMVrIueBNTH2GSk7ndk-p4EbBel3k9tP7q6SZqXfxLn3O0FBhJO2G8ffdC4Xq90MCV_zt_7quzve0ErBfNj3QZD0-dvFQW5JWusd9urYsAEhsGb_7wE4AQDiAX9vN22S5AGAaAGdoAH_6n4uwSoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAfgvbECqAf_nrECqAffn7EC2AcA0ggkCIBhEAEYHzICigI6CYBAgMCAgICACEi9_cE6WJCg_q-5voQDgAoByAsB4AsBgAwBqg0CSUywE7ifuRbIE52ileMD2BMKiBQI2BQB0BUB-BYBgBcB6BcF&sigh=XHIevHBJ5-s&label=vast_creativeview&ad_mt=5&acvw=sv%3D961%26v%3D20240216%26cb%3Dout%26e%3D19%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D37717%26vmtime%3D4%26is%3D33554450%26i0%3D33554450%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%3D200104%26avms%3Dnio%26qi%3D45572109%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,200104c,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0%26co%3D452055403&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0%26t%3D1708587754901

Domain: csi.gstatic.com
URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=5~lswx18dz&c=7881342935905&slotId=3940671467952.5&qqid=CKPUgbC5voQDFWEBTwgdisIL9A&fb=outstream-lima&gpm_i=8&gpm_c=8&gpm_a=8&smb=Infinity&br=2019&mt=video%2Fmp4&vs=1280x720&dm=37000&ple=0&umsem=0&event_name=first_play&asset_bytes=199857&video_bytes=300&cached_data_bytes=0&js_cached=false&css_cached=false&num_assets=10&num_assets_cached=0&num_assets_cache_validated=0&num_assets_unmeasurable=0&video_played_seconds=0.00&video_muted=true&video_seconds_loaded=0.00&met.4=vil.2nb~ff.2nl~videopreviewstarted.2nm

Verdicts & Comments Add Verdict or Comment

67 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.fileforum.com/	1969-12-31 23:59:59	Name: sixsession Value: ie05jtu9ea62m7a74huajgf3ueu8oijk
.fileforum.com/	1970-01-21 04:12:27	Name: _ga Value: GA1.1.1928486355.1708587751
.doubleclick.net/	1970-01-21 04:12:27	Name: IDE Value: AHWqTUmOv46vst8dEaX4qpGG1BOtjbwioUqghLh9XYsixXPezm2cq4KQiKtHV39hKYc
.fileforum.com/	1970-01-21 03:58:03	Name: __gads Value: ID=2a86b88f22d3fb00:T=1708587751:RT=1708587751:S=ALNI_MZ6SXeoIX-B17HzTgjB3o0ULdAJlw
.fileforum.com/	1970-01-21 03:58:03	Name: __gpi Value: UID=00000d5f0c15db8d:T=1708587751:RT=1708587751:S=ALNI_MYfRrCtRyWtUwRl1eOdVbDZf2ZGcQ
.fileforum.com/	1970-01-20 22:55:39	Name: __eoi Value: ID=dd851857b0619492:T=1708587751:RT=1708587751:S=AA-AfjauqX-XvnPhiUC7qiw57ZPd
.adnxs.com/	1970-01-20 20:46:03	Name: XANDR_PANID Value: LvjBEBP8dOSiWXQP6ouLDcDazRr6UJyyzhMZ-OrojgCcKXwPRe6HrmnGODiw2RzVQ3Jo-rj7rX-b4VBBWFWCthkOzVpHDXt9gS4wFuHXhPI.
.adnxs.com/	1970-01-21 04:12:27	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-20 20:46:03	Name: uuid2 Value: 6335923011306249661
.adnxs.com/	1970-01-20 20:46:03	Name: anj Value: dTM7k!M41.D>6NRF']wIg2E?^u'L!`!]tbPl1M>e)ZlrFUfJ+tGXxoD[41D8FunT6VFGLwORZ@Y1MmBNa`5MaDqZ3If)y3KL9D3I?+oL8G+q
.casalemedia.com/	1970-01-20 20:46:03	Name: CMPS Value: 4859
.fileforum.com/	1970-01-21 04:12:27	Name: _ga_H9SLV28721 Value: GS1.1.1708587751.1.0.1708587753.0.0.0
.casalemedia.com/	1970-01-21 03:22:03	Name: CMID Value: Zdb66IsFVsMAAFM4AGzo0AAA
.casalemedia.com/	1970-01-20 20:46:03	Name: CMPRO Value: 4725
.doubleclick.net/	1970-01-20 18:36:31	Name: DSID Value: NO_DATA
.fileforum.com/	1970-01-21 03:22:03	Name: FCNEC Value: %5B%5B%22AKsRol8upF6LqKoNVqNiDb2RrFO-r9nKSuKTW0Ztw9AKQh5tXlY1zGXscVKCgv06p7Zd1MylNTAV5669GmI4YGrq9GMPFQKhnZozXH4S4gVeiTIW1WbNTOvmSzAe5nPCsVfb6iOIZuWXIcwSwQ5tnNXR0dmAQi6Sqw%3D%3D%22%5D%5D

47 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://fileforum.com/profile/nurseraven8/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ade.googlesyndication.com
bid.g.doubleclick.net
cm.g.doubleclick.net
csi.gstatic.com
dsum-sec.casalemedia.com
fileforum.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
gcdn.2mdn.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
images.betanews.com
imasdk.googleapis.com
pagead2.googlesyndication.com
r5---sn-ua87sn76.c.2mdn.net
s0.2mdn.net
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gravatar.com
www.gstatic.com
ade.googlesyndication.com
csi.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
pagead2.googlesyndication.com
tpc.googlesyndication.com
104.26.12.174
108.44.238.29
142.250.181.226
142.250.181.238
142.250.185.106
142.250.185.163
142.250.185.238
142.250.185.72
142.250.185.98
142.250.186.106
142.250.186.129
142.250.186.130
142.251.12.120
172.217.16.130
172.217.16.196
172.217.18.6
172.64.151.101
185.89.210.212
192.0.73.2
216.58.212.174
74.125.71.157
74.125.98.170
068123d4c4589cecb90523791256c9c9277a306172601593fd9b6414420056f3
06f1ec52dea17ff1c6bed231b53938e5200586e1b37c6707f453b115454da806
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bd3e64a75f43409aa3141f35c5d1bd599773aec49d61aaa02522dbe6101c247
0e33434b042c688fa1972d51e9c103fe592fca7a4dd50358c08449c7b0f5cb4c
104c2ae6d04ed58367e47b13fd44c82071d1f6e0ff441ddc41555c7689ad6126
160d317860d283845ddde93faa4a3c41f42f0e777acb74dba3a716555c89610f
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1d548496dc31bd98c6b532f0ce18b1820a2bd744545e77e58105264f54b28580
1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306
1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954
245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c
28528db9f11cf1291c3e656a885c55cfd09e5f32d0b63805bdfd68cf5bdfe54e
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
34ad89f6e61b0cb2a9c36f5eafcb2e0e84555cc7827885586a83aa1b5a2d8e6c
34de0b876686b5e0e70169241a272564f2813e26def4572b91e79af258ad3d89
3a8f59aaec3baa11914a42d01b1513778de352d807ced7c5a7296f21b97e1848
3aaef75f011d2fc74f34f5f5885321eba4bf4dedab3e1eb4be78d1fee4da3cc5
3bdced3a3ce2d6a91489eddb8b904b96a2220d406e550a56bc7cb52ba732e0f7
3f01a7c5df0321e128865e698ab6476688ab6e88e49b09ae1f739063573579b6
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
425f9ca7029ca2c95d204079575a3e5f737ef4d322614225344c5aeadd51bfb8
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d
48639bd7695fc270e23859d9b74231f49bc78f05e3a96ed0332a9b0b80d8c2e4
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4ec57f2a80b91090971b83970230ca09ab3568c5f5b224896ca9aa6180a76aa9
529ce545d0f689295a76134ae7f6add7b8b78904a15b6bef1a5a6bd0cb47b281
54a4b0a512bee3f1de5932be2c69af90bc212c67e46812cef71da9325bd5fa80
54b646173856c05ad595598fcfee96dc54495c2f9a30ea1c55515b64789d2803
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
579b8daaa438c7b358005e655c44244e9d04d2dfaced4485b8ee93019915a3cd
5916e0b240cb97c609bce4253569ab210ddd5f3569b61d2c6ed8efe310844dc8
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5ea0a2bf2e4ba86815782535de2bf697c77611dc7bf30a709bc9220aa21c0c00
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
7087b3afc70c0f1a640c5327239e94a508b7a7751800b3952edf804a3837a2e8
716b2a35acfc8e6a247c9e4d9e3c32dc2354b3a8a6e6481835a64b783a5ba4a3
71a2933a8805045e2305cbd2824ab3bcc1a371f1e6d111645ce14cd7c7c5bf7a
78443af85ee16512679e682844ffcaa43ea42224c25ed61f6cedafcb76d63581
7dd237402d268d06f429c8c5101ea5432a2e5c188be7470a5b0413ba17b856ac
9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a4f8fdc9c6512ce6b72982e86467c139b976bbe1de224fbc7360318347f6c56e
a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd
a797e70bc52226063fae939bcd9f69b525838d0d9a466c30ed6a9defe8bf8244
acedd99a00a765ea62d82ebda52b76f72cc58fbb736a5f7b0154d519ce85f4ec
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bca910b1befa38ccd56ad9eb8529ab16148a69cfd05c5741b897103b1a4daa1c
c1c660d891e88b1989e6ee7da95952e4681461f599a0eb4927a49aa90c7dccc7
c1d6b998fbeddc17b9f8e6351eb4b97746a9bf8591ab1b23befb359737e25797
c35a031333f6e54a39fd4dc1752ff62d9f79fbaa7e23aa047589a3d1b02c0978
c505f5e6db32169df461ce182212a17730f85ef92957719327f7c7f6d76b4dd9
c8c04fa08f74366154e79d03524278c2ec82e40c7fd821d5b13a4bbda4381bbb
d3f4104957e76483acba4180738253208fd8d4d81c64931244860514af502b82
deda914cce5fb739ca5624e64be7af22f3a426623b3bf174429287d2376dfc4b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e519cc4b7b8fdc64a7aaafc1b808cde266a234205aac0d6c55589c12446d565e
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2
f061bc61c6a752564bba70c0675de98f06d26b6fe0655c2189fba606539accab
f200917c97d2c5c24c1db8e032dff80eed65392a0191fe2324e8ef121e7a393c
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fe00f6a25703ead073b6b2ce1a56c07fb5dcb6da14aa2c73a06dce0ffb90b9ab

fileforum.com Open in urlscan Pro 108.44.238.29 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

108 Requests

87 %HTTPS

0 %IPv6

13 Domains

24 Subdomains

22 IPs

3 Countries

1321 kBTransfer

4143 kBSize

16 Cookies

5 Outgoing links

Redirected requests

108 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

fileforum.com Open in urlscan Pro
108.44.238.29 Public Scan

Screenshot
Live screenshot

Full Image

108
Requests

87 %
HTTPS

0 %
IPv6

13
Domains

24
Subdomains

22
IPs

3
Countries

1321 kB
Transfer

4143 kB
Size

16
Cookies

108 HTTP transactions
2 data transactions